Cloudflare retires two legacy APIs in late September — the Registrar /registrar/domains endpoints and Service Key (X-Auth-User-Service-Key) authentication

Quiet night on the monitored feeds — the four things that changed there were routine version-lifecycle updates (Kubernetes 1.37, a Terraform release, two Ubuntu LTS dates), none with a near-term edge. The night’s real news came from a source that rewards reading closely: Cloudflare’s API deprecations page, which has two legacy interfaces reaching end-of-life three days apart in late September. Both are the kind of change that a person clicking around a dashboard will never notice and a script will discover the hard way.

New: Cloudflare’s legacy Registrar API — the /registrar/domains endpoints end 27 September

Cloudflare Registrar’s legacy API is being retired. Per Cloudflare’s own deprecations page, the old /accounts/{account_id}/registrar/domains endpoints were deprecated on 10 April 2026 and reach end-of-life on 27 September 2026, after which those calls are no longer supported. The Registrar feature stays — Cloudflare has published a new Registrar API in its place — so this is a migration, not a shutdown.

Who feels it: anything that manages Cloudflare-registered domains through the API on the old path — infrastructure-as-code, renewal and transfer scripts, portfolio automation. The new API is a re-shaped resource rather than a straight path rename, so the fix is a little more than find-and-replace: check the request and response shapes for the operations you use against the new reference, then update generated clients, Terraform, and CI before the date.

New: Cloudflare Service Key authentication — the X-Auth-User-Service-Key header stops working 30 September

Service Key authentication — API requests carrying the X-Auth-User-Service-Key header — was deprecated on 19 March 2026 and reaches end-of-life on 30 September 2026. After that the header no longer authenticates, and Cloudflare has already stopped issuing new Service Keys. Service Keys were mostly used for origin-certificate tooling, so the callers at risk are certificate-automation jobs and long-lived scripts still sending the header. Cloudflare explicitly tells cloudflared and origin-ca-issuer users to update to versions that use API Tokens.

The replacement is Cloudflare API Tokens, which Cloudflare says do everything Service Keys did with added scoping, expiration, and IP restrictions. The reason to move early is that auth doesn’t fail gracefully: it works up to the deadline, then rejects every request at once — and a certificate job that has run untouched for years is exactly where a forgotten Service Key hides.

Both of these are now detectable: the lastcall CLI fingerprints /registrar/domains and X-Auth-User-Service-Key, so a repo still using either surfaces as a warning in the terminal rather than a broken pipeline in late September.

On the board

• 31 August — comes due tomorrow: Delibr (export your product docs before deletion), GitHub Spark, Flowise cloud, the New Relic drop-filter-rules API, and the Power Automate mobile app.
• 1 September: SurfEasy VPN shuts down (the apps stop working entirely) and Azure retires its nested confidential cc_v5 VMs (resize them or they’re deallocated).

Further out: OpenSSL 3.0 (7 September), the GitHub Copilot MAI-Code-1-Flash deprecation (10 September), the Relay and Microsoft Sentinel SAP connector agent retirements (both 14 September), then Cloudflare’s two end-of-life dates on 27 and 30 September, the OpenAI Sora 2 video API shutdown (24 September), and MTurk on 30 September. The full board with live countdowns is on the calendar.

We re-checked one more time for Google’s widely-reported 4 September removal of Google Assistant on mobile: still no first-party dated page — the date reaches us only through Google’s user emails and press coverage — so the Google Assistant → Gemini entry stays without a countdown, per our no-inferred-dates rule.