Multiple Service Auth Tokens

We are using Cloudflare Access and Service Auth tokens. Today around 4pm UTC a number of services could no longer be accessed using Service Auth tokens.

The issue seems to be affecting Cloudflare Applications that have multiple Service Auth policies. Only the topmost Service Auth policy now succeeds - the ones below it fail. This also happens if trying to use one policy with multiple Service Auth tokens (OR logic).

This means that only one service token can successfully reach the application. Other auth methods on the same application (e.g. user emails) don't appear to be affected.
Was this page helpful?