Authentication retirement · Scheduled · High confidence

Cloudflare retires Service Key authentication

Cloudflare is removing Service Key authentication on 30 September 2026, requiring affected API integrations to move to scoped API Tokens.

Evidence boundary: Only integrations using Service Keys are affected. Other supported Cloudflare authentication methods continue.

What changes

The X-Auth-User-Service-Key mechanism is retired. API callers must use current authentication, normally scoped API Tokens.

Who is affected

Automation that sends the Service Key header.
Legacy scripts and integrations provisioned before API Tokens became the standard.
Teams that have not mapped existing Service Key privileges to least-privilege token scopes.

Timeline

Service Keys stop working after 30 September 2026.

Required action

Find all callers using X-Auth-User-Service-Key.
Create appropriately scoped API Tokens.
Update and test integrations before the deadline.
Remove the legacy key from operational documentation and secret stores after cutover.

What is not affected

Cloudflare APIs and supported token-based authentication continue. The retirement is limited to the Service Key mechanism.

PlatformTrace analysis

This is a hard authentication boundary: an otherwise unchanged API request will fail after the legacy key is removed.

Sources

Cloudflare API deprecations.

Corrections and updates

No correction is currently open. Any deadline extension or migration clarification will be dated.