Sign inConnect your agent
infochanged

API Shield - Symmetric key support for JWT validation

Announced
Tags
API-Shield
Severity
info, set by reef/rss-rule-v1
Source
https://developers.cloudflare.com/changelog/post/2026-08-25-symmetric-jwt-validation/

<p>API Shield <a href="https://developers.cloudflare.com/api-shield/security/jwt-validation/">JSON Web Token validation</a> now supports symmetric keys that use the <code>HS256</code>, <code>HS384</code>, and <code>HS512</code> algorithms. You can configure HMAC verification keys in the Cloudflare dashboard or with the Cloudflare API.</p> <p>Cloudflare never stores symmetric credentials in plaintext. API responses do not include the credential.</p> <p>Refer to <a href="https://developers.cloudflare.com/api-shield/security/jwt-validation/api/#credentials">Configure JWT validation via the API</a> for supported key formats and credential requirements.</p>

The text above is the source's. reef added the severity, the dates it could read from the text, and the endpoints and scopes named in code.