Deleted API Token still works?!
I deleted a User API Key but it is still working.
Surely this isn't expected?
Surely this isn't expected?
LChecking with this script I dont see any tokens in either:
Common headers
headers = {
"X-Auth-Email": CF_EMAIL,
"X-Auth-Key": CF_API_KEY,
"Content-Type": "application/json",
}
── 1. List all user-level API tokens ──
user_tokens_url = "https://api.cloudflare.com/client/v4/user/tokens"
resp = requests.get(user_tokens_url, headers=headers)
print("User-level tokens response:")
print(json.dumps(resp.json(), indent=2))
── 2. List all account-level API tokens ──
account_tokens_url = f"https://api.cloudflare.com/client/v4/accounts/%7BCF_ACCOUNT_ID%7D/tokens"
resp = requests.get(account_tokens_url, headers=headers)
print("\nAccount-level tokens response:")
print(json.dumps(resp.json(), indent=2))
Common headers
headers = {
"X-Auth-Email": CF_EMAIL,
"X-Auth-Key": CF_API_KEY,
"Content-Type": "application/json",
}
── 1. List all user-level API tokens ──
user_tokens_url = "https://api.cloudflare.com/client/v4/user/tokens"
resp = requests.get(user_tokens_url, headers=headers)
print("User-level tokens response:")
print(json.dumps(resp.json(), indent=2))
── 2. List all account-level API tokens ──
account_tokens_url = f"https://api.cloudflare.com/client/v4/accounts/%7BCF_ACCOUNT_ID%7D/tokens"
resp = requests.get(account_tokens_url, headers=headers)
print("\nAccount-level tokens response:")
print(json.dumps(resp.json(), indent=2))
LAlso checking the verify endpoint it shows invalid however it still works:
User token verification response:
{
"success": false,
"errors": [
{
"code": 1000,
"message": "Invalid API Token"
}
],
"messages": [],
"result": null
}
Account token verification response:
{
"success": false,
"errors": [
{
"code": 1000,
"message": "Invalid API Token"
}
],
"messages": [],
"result": null
}
User token verification response:
{
"success": false,
"errors": [
{
"code": 1000,
"message": "Invalid API Token"
}
],
"messages": [],
"result": null
}
Account token verification response:
{
"success": false,
"errors": [
{
"code": 1000,
"message": "Invalid API Token"
}
],
"messages": [],
"result": null
}
L@Leo Thanks. but when I change my keys (Global API Key and Origin CA Key) the key still works?
I don't have any keys here (Account API tokens)
or here:
I don't have any keys here (Account API tokens)
or here:
LI deleted all my keys just to be sure
LSo I can reproduce on the same account but cannot reproduce it on another account. So it seems like my account is just bugged.
LSo I have a key in limbo where I cant see it anywhere to delete but can still use it.
LI guess removing it from my app is as good as deleting but feels like a hack @Leo
