Access, Cloudflare One - New strict service token authentication setting for Access

<p>The strict service token authentication setting applies consistent behavior to requests made with service tokens. When the setting is on for a Zero Trust organization, Access handles requests with service token headers as follows:</p> <ul> <li>If authentication or authorization fails, Access always returns <code>401</code> or <code>403</code> instead of redirecting the client to the login page with <code>302</code>.</li> <li>Only Service Auth policies can authorize the request. Access ignores Allow policies and any <code>CF_Authorization</code> cookie sent with the request.</li> <li>Access does not return a <code>CF_Authorization</code> cookie to the client after successful authentication. Subsequent requests should continue to use service token headers.</li> <li>Failed requests for recognized service tokens appear in <a href="https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/#non-identity-authentication">Access authentication logs</a>.</li> </ul> <p>Zero Trust organizations created on or after October 5, 2026 have strict service token authentication turned on by default and cannot turn it off. Cloudflare recommends that existing organizations turn it on as well.</p> <p>Organizations created before October 5, 2026 can configure the setting in the dashboard or through the API.</p> <div data-nb-tabs data-nb-sync-key="dashPlusAPI" class><div class="relative flex border-b border-border" role="tablist" data-nb-tabs-list><span class="bg-primary pointer-events-none absolute -bottom-px h-0.5 rounded-t-sm transition-[left,width] duration-200 ease-out" data-nb-tabs-indicator aria-hidden="true"></span></div><div class="mt-3"><div role="tabpanel" data-nb-tabs-content data-nb-tab-label="Dashboard" class><div data-nb-steps class="steps" data-astro-cid-sfejetki><ol> <li> <p>In the <a href="https://dash.cloudflare.com/" target="_blank" rel="noopener">Cloudflare dashboard<span class="external-link"> ↗︎</span></a>, go to <strong>Zero Trust</strong> &gt; <strong>Access controls</strong> &gt; <strong>Access settings</strong>.</p> <a href="https://one.dash.cloudflare.com/?to=/:account/access-controls/settings" data-nb-button class="group inline-flex w-max shrink-0 items-center justify-center rounded-full font-medium whitespace-nowrap no-underline shadow-xs transition-colors cursor-pointer select-none focus-visible:outline-2 focus-visible:outline-ring focus-visible:outline-offset-2 disabled:cursor-not-allowed disabled:opacity-50 bg-primary text-primary-foreground hover:bg-primary-hover h-9 gap-1.5 px-3 text-sm" target="_blank"> Go to <strong>Access settings</strong>&nbsp;&#8599; </a> </li> <li> <p>Under <strong>Manage service tokens</strong>, turn on <strong>Strict service token authentication</strong>.</p> </li> <li> <p>In the confirmation dialog, select <strong>Enable</strong>.</p> </li> </ol></div><script type="module" src="https://developers.cloudflare.com/home/runner/work/cloudflare-docs/cloudflare-docs/src/components/ui/steps/Steps.astro?astro&type=script&index=0&lang.ts"></script><p>To turn off strict service token authentication, turn off the setting and select <strong>Disable</strong>.</p></div><div role="tabpanel" data-nb-tabs-content data-nb-tab-label="API" class><figure class="nb-code-figure" data-nb-lang="bash"><pre class="astro-code astro-code-themes github-light github-dark nb-shiki-c6xiwz" tabindex="0" data-language="bash" data-nb-lang="bash"><code><span class="line"><span class="nb-shiki-1t8gfj">curl</span><span class="nb-shiki-mdbnqw"> "https://api.cloudflare.com/client/v4/accounts/%7Baccount_id%7D/access/organizations"</span><span class="nb-shiki-dzsirb"> \</span></span> <span class="line"><span class="nb-shiki-dzsirb"> --request</span><span class="nb-shiki-mdbnqw"> PATCH</span><span class="nb-shiki-dzsirb"> \</span></span> <span class="line"><span class="nb-shiki-dzsirb"> --header</span><span class="nb-shiki-mdbnqw"> "Authorization: Bearer </span><span class="nb-shiki-140thh">$CLOUDFLARE_API_TOKEN</span><span class="nb-shiki-mdbnqw">"</span><span class="nb-shiki-dzsirb"> \</span></span> <span class="line"><span class="nb-shiki-dzsirb"> --json</span><span class="nb-shiki-mdbnqw"> '{</span></span> <span class="line"><span class="nb-shiki-mdbnqw"> "strict_service_token_auth": true</span></span> <span class="line"><span class="nb-shiki-mdbnqw"> }'</span></span></code></pre></figure><p>To turn off strict service token authentication, set <code>strict_service_token_auth</code> to <code>false</code>.</p></div></div></div><script type="module" src="https://developers.cloudflare.com/home/runner/work/cloudflare-docs/cloudflare-docs/src/components/ui/tabs/Tabs.astro?astro&type=script&index=0&lang.ts"></script> <p>For behavior and configuration details, refer to <a href="https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/#strict-service-token-authentication">Strict service token authentication</a>.</p>