Cloudflare Security Configuration: Tokens, Access, WAF

A Cloudflare account sits in front of DNS, TLS, the WAF and often internal applications, so one over-privileged API credential or dashboard login can change how all of that traffic is handled. This guide covers the configuration settings that decide who and what can change a Cloudflare account: member roles, dashboard SSO and 2FA, API tokens versus the legacy Global API Key, Cloudflare Access service tokens and Tunnel, WAF managed rules and origin protection, and audit logging. It is written for platform, network and security engineers who own or review a Cloudflare tenant. Product behaviour is taken from Cloudflare's own documentation; the guide explains settings and trade-offs and does not compare or recommend vendors.

Key takeaways

Retire the Global API Key. It carries every permission of the user who owns it, cannot be scoped, IP-restricted or given an expiry, and only one exists per user, which makes clean rotation hard.
Prefer account-owned API tokens for automation. Account API tokens are not tied to a person, so they survive staff leaving, and each can be limited to specific permission groups, zones, source IPs and a time window.
Keep Super Administrator for a named few. Most engineers need a scoped role such as DNS, Firewall or Domain Administrator, and the roles that create tokens or manage members deserve the same care as cloud root.
Treat Access service tokens and Tunnel credentials as secrets with owners. Every Client ID and secret pair needs an owner, an expiry, an alert before it expires and a tested rotation path.
Export audit logs before you need them. Audit Logs v2 keeps 18 months but the dashboard only searches 90 days, so send the audit_logs_v2 dataset to your SIEM through Logpush and alert on token, member and policy changes.

How identity and access work in Cloudflare

Cloudflare separates three kinds of identity, and most hardening mistakes come from mixing them up.

Members (people): users with a Cloudflare login who are invited to an account and given one or more roles. Roles are either account-scoped (apply to every zone in the account) or domain-scoped (apply to one zone). Members sign in with email and password plus 2FA, or through dashboard SSO to your identity provider.
API credentials (automation): user API tokens created under My Profile, account API tokens created under Manage Account, and the legacy Global API Key. Terraform, CI pipelines, certificate tooling and DNS automation usually run on these.
Zero Trust identities (traffic): users and devices that Cloudflare Access evaluates when they reach a protected application, plus service tokens and mutual TLS certificates for machines that cannot use an identity provider. These control access to your applications, not to the Cloudflare account itself.

Members and API credentials are the control plane; Access policies are the data plane. A token with Cloudflare Access edit rights can rewrite the data plane, so protect control plane identities first.

Credential type	Bound to	Scope controls	Typical use	Main risk
Global API Key (legacy)	One user	None: same permissions as the user, all of the user's resources	Old scripts and integrations	Full account takeover if leaked; one key per user so rotation breaks things
User API token	One user	Permission groups (Account, User, Zone; Edit or Read), resources, client IP filtering, TTL	Personal tooling, short tasks	Breaks or lingers when the user leaves
Account API token	The account (service token, not a person)	Same as user tokens where the endpoint is supported	CI/CD, Terraform, integrations	No natural owner unless you assign one
Access service token	Zero Trust organisation	Access policies with the Service Auth action; duration	Machine access to Access-protected apps	Long durations, shared secrets, forgotten tokens
Tunnel connector credentials	A named tunnel (UUID)	Routes and Access policies on the tunnel's hostnames	Publishing private services through cloudflared	Anyone holding them can run a connector for that tunnel

Admin roles and privileged access

Cloudflare's role list is long and granular, which is helpful: there is almost always a narrower role than Administrator. Group roles by blast radius when you design assignments.

Role (Cloudflare name)	What it grants	Treat as
Super Administrator - All Privileges	Everything, including billing, members and account-owned API tokens; can revoke other Super Administrators	Tier 0: two or three named people, hardware-key 2FA, break-glass process
Administrator	Full account access and subscription edits, but not member or billing profile management	Tier 0 for configuration; avoid as a default role
API Token Provisioning	Create account API tokens	Privileged: anyone with it can mint new credentials
Cloudflare Zero Trust / Cloudflare Access	Admin over all Zero Trust products, or edit Access policies and Tunnel	Privileged: controls who reaches internal applications
Firewall, DNS, SSL/TLS and related	Edit WAF and IP Access rules, DNS records, or TLS and caching settings	Operational, scoped to the team that owns the function
Workers Platform Admin, Secrets Store Admin	Edit Workers, Pages, KV, R2; create and edit secrets	Privileged for application owners: code at the edge sees traffic
Domain Administrator	Full access to one domain with read-only view of account-wide Firewall, Access and Workers	Preferred for zone owners in multi-domain accounts
Administrator Read Only, Audit Logs Viewer, Analytics	Read-only views	Default for reviewers, auditors and SOC analysts

Enforce 2FA for everyone: Super Administrators can switch on 2FA Enforcement, which requires every member to enable 2FA before accepting an invitation. Cloudflare supports TOTP apps, WebAuthn security keys and email codes. For privileged members, require security keys and register at least two.
Move logins to dashboard SSO: an SSO connector, verified with a cloudflare_dashboard_sso= TXT record, forces every user on your email domain through your identity provider, including users who had accounts before. That puts joiner, mover and leaver control and phishing-resistant MFA in your IdP. See the Identity Provider and SSO Security Guide.
Plan the SSO break-glass path: Cloudflare documents two recovery options if the IdP fails: an Account API token with the SSO Connector Edit permission stored offline, which can disable the connector by API, and a one-time PIN identity provider added as a backup. Choose one, store it as you would cloud root credentials, and test it. See the Break-Glass Account Guide.
Do not delete the generated policy: the auto-generated "allow email domain" policy on the dashboard SSO application keeps administrators able to sign in. Removing it is a lockout.
Review membership quarterly: export members and roles, and remove contractors, departed staff and personal email addresses.

Integrations, API tokens and service accounts

Most of a mature Cloudflare account's change volume comes from automation, so most of the risk sits in API credentials. Cloudflare's documentation is direct on the main point: use API tokens instead of the Global API Key where possible, and existing users are encouraged to migrate.

Design rules for API tokens

One token per integration: a Terraform pipeline, a certificate manager and a DNS sync job each get their own token, so you can revoke one without breaking the others and audit entries name a specific integration.
Smallest permission group: pick Read wherever the job only reads; Edit grants full create, read, update, delete and list. A DNS automation token needs Zone DNS Edit on named zones, not account-wide permissions.
Resource scoping: restrict tokens to the zones they manage. A token scoped to Zone DNS Read on one zone gets an error on any other zone.
Client IP address filtering: limit tokens used by fixed infrastructure (self-hosted runners, NAT gateways) to those source ranges. Where hosted CI egress changes, use short TTLs instead.
TTL: set start and end dates on tokens for projects, migrations and contractors, so the credential expires even if nobody remembers it.
Account-owned for shared automation: create account API tokens for pipelines so they do not belong to an engineer. Check Cloudflare's compatibility list first, as not every endpoint supports account tokens yet.
Store and scan: the secret is shown once, so write it straight to a secrets manager. New tokens use a cfut_ prefix (and new Access service token secrets a cfast_ prefix), which secret scanners can detect; enable those patterns in repository and CI scanning. See the API Key Management Guide.
Verify, then rotate: test a new token against /user/tokens/verify before cutting over, then revoke the old token.

Access service tokens and Tunnel

Service tokens: machines present CF-Access-Client-Id and CF-Access-Client-Secret headers, and the application's policy must use the Service Auth action; otherwise Access sends the client to an identity provider login. Choose the shortest Service Token Duration the integration can tolerate (Cloudflare's API example uses 8760h, one year), turn on the Expiring Access Service Token alert, which fires a week before expiry, and use rotation, which issues a new Client Secret under the same Client ID with a grace period from one hour to 30 days.
Prefer mutual TLS for devices: where a client can hold a certificate, Service Auth with mTLS avoids a shared static secret. See the Machine Identity, PKI and Certificate Lifecycle Guide.
Tunnel: cloudflared makes outbound-only connections to Cloudflare, so the origin can block all inbound traffic. The trade-off is that traffic flows both ways once the tunnel is up, so anyone who obtains a tunnel's credentials can run a connector and serve or receive traffic for its routes. Keep tunnel credentials in a secrets manager, put an Access Allow policy (not Bypass) in front of every tunnelled hostname, and alert on new connectors. Attackers also abuse tunnelling services (T1572 Protocol Tunneling), so know which tunnels are yours.

The Cloudflare Thanksgiving Breach 2023 shows why integration credentials need the same lifecycle as human ones. After the Okta support system breach, Cloudflare rotated thousands of credentials but missed one service token and three service accounts it believed were unused. An attacker used them to reach Confluence, Jira and Bitbucket, and a Smartsheet account with Jira admin rights let them install persistence through a Jira plugin. The lesson for any SaaS tenant, Cloudflare included: inventory every token with last-used data, rotate everything that may have been exposed, and keep integration privileges narrow. See the Service Account Security Guide.

Logging and detection

Audit Logs v2 records user-initiated create, update, delete and view actions from the dashboard and API, plus system-initiated changes, across about 95% of products. Each entry carries the actor, result, account, resource and request details such as method, URI, status and Ray ID. Logs are retained for 18 months, but the dashboard only queries the last 90 days and hides view actions by default.

Export: create a Logpush job for the Audit Logs v2 dataset (audit_logs_v2). Existing v1 jobs do not carry over, so check that older pipelines still receive data. The API endpoint is GET /client/v4/accounts/{account_id}/logs/audit with required since and before parameters.
Traffic logs: send HTTP request and firewall event datasets to the same SIEM so WAF decisions can be correlated with configuration changes.
Access and Gateway logs: keep Zero Trust authentication logs, because Bypass policies do not log requests at all. See the Cloud Logging and Audit Trail Guide.

Event to alert on	Why it matters	ATT&CK technique
API token created, rolled or permissions widened; Global API Key viewed or changed	New or wider credentials are the usual persistence route	T1098.001 Additional Cloud Credentials
Member invited, role changed to Administrator or Super Administrator, 2FA enforcement disabled	Privilege escalation or weakening of sign-in controls	T1098 Account Manipulation
API calls from a token outside its usual source IPs or hours	Possible use of a stolen token	T1078.004 Cloud Accounts
Access policy changed to Bypass, Allow rule broadened, service token created	Opens internal applications	T1199 Trusted Relationship
New tunnel or new connector on an existing tunnel	Unknown path into or out of private networks	T1572 Protocol Tunneling
WAF managed ruleset disabled, skip exception added, DNS record pointed elsewhere	Removes protection or reroutes traffic	T1190 Exploit Public-Facing Application (enabler)

Metrics that show the controls are working

Global API Keys in use: target zero; track the count of users whose key appears in audit logs.
Tokens with an owner, expiry and IP filter: percentage of active tokens meeting all three.
Super Administrators: absolute count, reviewed monthly.
Service tokens expiring without rotation: count of Expiring Access Service Token alerts not actioned within the week.
Zones with managed rules in block mode and origin protection on: percentage of proxied production zones.

Hardening baseline

WAF managed rules

Availability depends on plan: the Free Managed Ruleset is on all plans; the Cloudflare Managed Ruleset and Cloudflare OWASP Core Ruleset need Pro or above; Sensitive Data Detection is Enterprise only. The Exposed Credentials Check ruleset is deprecated in favour of leaked credentials detection. Each managed rule has a default action that varies with severity, and the OWASP Core Ruleset blocks when a request's cumulative threat score exceeds the threshold you configure.

Tune with overrides, not by disabling rulesets: overrides can target a ruleset, tags or individual rules. Exceptions (skip rules) take priority over overrides, so keep them narrow, with a ticket reference in the description. See the Web Application Firewall Guide.
Protect the origin: a WAF is bypassed if attackers can reach the origin's IP directly. Use SSL/TLS mode Full (strict) and Authenticated Origin Pulls with a zone-level or per-hostname certificate; the global certificate only proves a request came from Cloudflare, not from your account. For services behind Tunnel, block inbound traffic at the origin firewall instead.

Phased rollout

Inventory (week 1): export members and roles, list every API token and Global API Key in use (audit logs show the actor), every Access service token, every tunnel and every zone's WAF state. Assign an owner to each.
Lock the front door (weeks 1 to 2): turn on 2FA Enforcement, cut Super Administrators to the minimum, and enable dashboard SSO with a tested break-glass path. Pilot SSO on a non-production account first if you have one; roll back by disabling the connector through the API token kept for that purpose.
Replace keys (weeks 2 to 6): for each integration, create a scoped account token, deploy it, verify, then revoke the Global API Key usage. Watch audit logs for a week for calls that still use the old key before rotating it.
Zero Trust credentials (weeks 4 to 8): set durations and expiry alerts on service tokens, replace Bypass policies with Allow or Service Auth, and move tunnel credentials into a secrets manager.
WAF and origin (weeks 4 to 10): deploy managed rulesets with Log as the action on a sample of rules where your plan allows, review hits, then move to default actions zone by zone. Enable Authenticated Origin Pulls after confirming every proxied hostname presents through Cloudflare; roll back by disabling AOP at zone level.

Decision guidance

Small organisations with one account and a handful of zones: 2FA Enforcement with security keys, two Super Administrators, scoped tokens per tool and a Logpush job to whatever log store you have is a sound baseline.
Large or regulated organisations: separate accounts for production and non-production (the Global API Key cannot separate them), domain-scoped roles for zone owners, account tokens issued only through a pipeline that records owner and expiry, and SIEM detections on the events above.
Service token or mTLS: choose service tokens for SaaS and scripts that can only send headers; choose mTLS where clients can hold a private key in a TPM or secure enclave.

Common misconfigurations

"Unused" credentials left alive: the Cloudflare Thanksgiving Breach 2023 turned on credentials believed to be unused. Verify inactivity from logs, then revoke.
Global API Key in CI: a leaked key carries everything its user can do, across production and test zones alike.
Everyone is an Administrator: granted for convenience during onboarding and never reduced; scoped roles exist for almost every function.
Bypass used as "allow": Bypass disables Access enforcement and logging. Cloudflare does not recommend it for permanent access to internal applications.
Origin reachable directly: WAF in front, but the origin accepts traffic from anywhere, or Flexible TLS leaves the Cloudflare-to-origin leg unencrypted.
Tokens and HAR files in tickets and wikis: the Okta support system breach began with session tokens inside uploaded HAR files. Sanitise HAR files and never paste tokens into tickets.

Framework mapping

Control area	NIST SP 800-53 Rev. 5	NIST CSF 2.0	CIS Controls v8.1
Member and token inventory, ownership, expiry	AC-2 Account Management, IA-5 Authenticator Management	PR.AA-01	Control 5 Account Management
Scoped roles and tokens	AC-6 Least Privilege, AC-6(5) Privileged Accounts	PR.AA-05	Control 6 Access Control Management
2FA and SSO for administrators	IA-2(1) Multi-factor Authentication to Privileged Accounts	PR.AA-01	Control 6 Access Control Management
Audit logs and Logpush	AU-2, AU-6, AU-12	PR.PS-04, DE.CM-01	Control 8 Audit Log Management
WAF, TLS mode, origin protection	SC-7 Boundary Protection, SC-8 Transmission Confidentiality and Integrity, CM-6 Configuration Settings	DE.CM-01	Control 13 Network Monitoring and Defense

Practitioner checklist

Turn on 2FA Enforcement and require security keys for Super Administrators and Administrators.
Enable dashboard SSO for your email domain and test the documented break-glass path.
Reduce Super Administrator to two or three named people and replace Administrator with scoped roles.
Replace every Global API Key integration with a scoped, account-owned API token with IP filtering and TTL where practical.
Record owner, purpose, scope, expiry and last use for every API token, service token and tunnel.
Set Access service token durations, enable expiry alerts and rehearse rotation with a grace period.
Replace Bypass policies on internal applications with Allow or Service Auth.
Run managed WAF rulesets with tuned overrides and protect origins with Full (strict) and Authenticated Origin Pulls or Tunnel.
Push audit_logs_v2 to your SIEM and alert on token, member, Access policy and tunnel changes.
After any third-party or IdP breach, rotate every Cloudflare credential that may have been exposed, not only the ones believed active.

Standards and references

Related NHI Mgmt Group resources: API Key Management Guide · Web Application Firewall Guide · ZTNA Guide · SASE and SSE Guide · Zscaler Security Configuration Guide

Cloudflare Security Configuration Guide: API Tokens, Zero Trust and WAF Settings