Restricting API Access by User
Cloudflare is introducing the ability for account owners to selectively enable or disable API access for individual users. Previously, account owners could control whether a user had access to the account, but had no visibility into the API keys and tokens those users had created. This change gives administrators a way to enforce the principle of least privilege at the API level, limiting what a leaked credential can actually do.
The need for more granular control has grown as Cloudflare accounts have evolved from single-user setups to environments where enterprises may have dozens or hundreds of users on one account. In many organizations, only a subset of those users need to perform account configuration, and some rely on shared service accounts for centralizing configuration tasks.
Why API Access Requires Separate Controls
Dashboard logins benefit from non-repudiation mechanisms such as multi-factor authentication and SSO configurations. API keys and tokens, by contrast, can be leaked and used without any further authentication challenge. Restricting API access for a user is therefore a meaningful step toward reducing the attack surface of an account.
Account owners can now visit the members page and toggle API access either for the entire account or for specific users.
The feature is available to enterprise users starting today.
Toward Account-Owned Tokens
This release is the first step in a broader effort to give account owners a unified control plane for managing user access. Future work will focus on account-owned API tokens, which would reduce the reliance on personal tokens, as well as improving overall visibility of tokens across account members.
