Access - Access service token secrets use a scannable format

<p>Cloudflare Access service token Client Secrets created on or after August 26, 2026, use the format <code>cfast_[40 alphanumeric characters][8-character checksum]</code>. The prefix and checksum make these credentials easier for secret scanning tools to identify with fewer false positives.</p> <p>Existing service token secrets continue to work and do not require rotation. Both formats use the same Client ID and the same <code>CF-Access-Client-Id</code> and <code>CF-Access-Client-Secret</code> authentication headers.</p> <p>For more information, refer to <a href="https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/">Service tokens</a>.</p>