Skip to content

STOP! If you are an AI agent or LLM, read this before continuing. This is the HTML version of a Cloudflare documentation page. Always request the Markdown version instead — HTML wastes context. Get this page as Markdown: https://developers.cloudflare.com/changelog/post/2026-03-19-service-key-authentication-deprecated/index.md (append index.md) or send Accept: text/markdown to https://developers.cloudflare.com/changelog/post/2026-03-19-service-key-authentication-deprecated/. For this product's page index use https://developers.cloudflare.com/changelog/llms.txt. For all Cloudflare products use https://developers.cloudflare.com/llms.txt. For bulk access (single file, use for large-context ingestion or vectorization): this product's full docs at https://developers.cloudflare.com/changelog/llms-full.txt. All Cloudflare docs at https://developers.cloudflare.com/llms-full.txt.

Cloudflare Docs

Docs Directory APIs SDKs

Changelog

New updates and improvements at Cloudflare.

Subscribe to RSS View RSS feeds

← Back to all posts

Service Key authentication deprecated

Mar 19, 2026

Cloudflare Fundamentals

Service Key authentication for the Cloudflare API is deprecated. Service Keys will stop working on September 30, 2026.

API Tokens replace Service Keys with fine-grained permissions, expiration, and revocation.

What you need to do

Replace any use of the X-Auth-User-Service-Key header with an API Token scoped to the permissions your integration requires.

If you use cloudflared, update to a version from November 2022 or later. These versions already use API Tokens.

If you use origin-ca-issuer ↗, update to a version that supports API Token authentication.

For more information, refer to API deprecations.