API
Cloudflare
Cloudflare retires Service Key API authentication; requests using the X-Auth-User-Service-Key header stop being accepted and callers must move to Cloudflare API Tokens
departs 30 Sept 2026
Quick answers
- Is it true that Cloudflare removes Service Key authentication — the X-Auth-User-Service-Key header stops working 30 September 2026?
- Yes. Cloudflare has officially announced it, effective 30 Sept 2026. This affects any code or tool that authenticates to the Cloudflare API with a Service Key, sent in the X-Auth-User-Service-Key header.
- When does it take effect?
- 30 Sept 2026. Verified against the vendor's own announcement.
- What should I use instead?
- Switch to Cloudflare API Tokens, which Cloudflare says provide all the functionality of Service Keys plus fine-grained permission scoping, expiration, and IP-address restrictions.
What this means for you
This affects any code or tool that authenticates to the Cloudflare API with a Service Key, sent in the X-Auth-User-Service-Key header. Per Cloudflare's deprecations page, Service Key authentication was deprecated on 19 March 2026 and reaches end-of-life on 30 September 2026; after that date requests using the header are no longer authenticated, and new Service Keys can no longer be generated from the dashboard or API. Service Keys were most often used for a narrow set of operations such as issuing origin CA certificates, so the highest-risk callers are automation around origin certificates and any long-lived scripts still carrying the header. Cloudflare specifically calls out users of cloudflared and origin-ca-issuer, telling them to update to versions that use API Tokens. The failure mode is the usual one for an auth retirement: nothing changes until the date, then every request on the old credential starts coming back as an authentication error — so a certificate-issuance job or an integration that has quietly worked for years can break all at once.
Where to go
Switch to Cloudflare API Tokens, which Cloudflare says provide all the functionality of Service Keys plus fine-grained permission scoping, expiration, and IP-address restrictions. Create a token scoped to only the permissions the workload needs, replace the X-Auth-User-Service-Key header with a standard Authorization: Bearer <token> header (or the token field your SDK expects), and remove the old Service Key. If you run cloudflared or origin-ca-issuer, update them to a version that authenticates with API Tokens rather than a Service Key — Cloudflare names both explicitly. Do the swap before 30 September 2026. If you also manage domains through the legacy Registrar API, note its separate end-of-life three days earlier, on 27 September 2026.
- Cloudflare API Tokens — the recommended replacement, with scoped permissions, expiration, and IP restrictions (developers.cloudflare.com/fundamentals/api/get-started/create-token/)
- For origin certificates specifically, updated cloudflared and origin-ca-issuer releases that authenticate with API Tokens
Cloudflare is retiring one of its older ways of authenticating to the API. On its API deprecations page, the company lists Service Key authentication — requests carrying the X-Auth-User-Service-Key header — as deprecated on 19 March 2026, with an end-of-life date of 30 September 2026. After that date, the header no longer authenticates requests, and Cloudflare has already stopped allowing new Service Keys to be generated from the dashboard or API.
Service Keys were a special-purpose credential, most commonly used for issuing origin CA certificates rather than for general API access, so this is narrower than a full auth overhaul — but for the workloads that do rely on it, it is a hard cutover. The callers most likely to be affected are certificate-automation tools and long-lived scripts that still send the old header. Cloudflare names two by name: users of cloudflared and origin-ca-issuer are told to update to versions that authenticate with API Tokens.
The replacement is Cloudflare API Tokens, and Cloudflare frames the move as an upgrade: it says tokens do everything Service Keys did, with the addition of fine-grained permission scoping, expiration, and IP-address restrictions. In practice the migration is: mint a token scoped to just the permissions the job needs, swap the X-Auth-User-Service-Key header for a standard Authorization: Bearer token (or the token field your client library expects), and retire the old key. If your certificate issuance runs through cloudflared or origin-ca-issuer, upgrading those to an API-Token-capable release is the whole task.
The reason to do it now rather than on the last day is the shape of the failure. An authentication method does not degrade gracefully — it works right up to the deadline and then rejects everything at once. A quiet, reliable certificate-issuance job is exactly the kind of thing that has been running untouched for long enough that nobody remembers it still uses a Service Key, which is what makes 30 September 2026 worth putting on a calendar. This retirement sits three days after Cloudflare’s legacy Registrar API end-of-life on 27 September, part of the same cluster of dates on Cloudflare’s deprecations page.
Entry changelog
- — last reviewed.
- — Entry created from Cloudflare's official API deprecations page (developers.cloudflare.com/fundamentals/api/reference/deprecations). Deprecation date 19 March 2026, end-of-life 30 September 2026, the affected X-Auth-User-Service-Key header, the cloudflared / origin-ca-issuer callout, and the API Tokens replacement all quoted from that page. Added a detect: fingerprint (text:X-Auth-User-Service-Key) so the lastcall CLI flags code still sending the deprecated auth header.
Put this countdown in your README
Building on Cloudflare? Drop this badge into a project’s README or docs — it shows the days left and
refreshes on its own every night from this page. 
[](https://lastcall.dev/entries/cloudflare-service-key-authentication-eol)Spot an error or a changed date? Tell us and it’s corrected the same night.