Access, Cloudflare One - GitHub automatically detects leaked Access service tokens

GitHub secret scanning automatically detects Cloudflare Access service token secrets exposed in public repositories and reports them to Cloudflare. Access then disables the affected token and emails account administrators.

Other secret scanning tools can identify Access service tokens using their consistent Client Secret format: cfast_, followed by 40 alphanumeric characters and an eight-character hexadecimal checksum. For tools that support custom detection rules, use this regular expression to find possible secrets:

cfast_[A-Za-z0-9]{40}[a-f0-9]{8}

This pattern applies to Client Secrets created on or after August 26, 2026, not legacy 64-character hexadecimal secrets. Matching the pattern does not validate the checksum or confirm that the secret is active. For details, refer to Client Secret format.

Recover a leaked service token

Before you can re-enable a leaked token, you must rotate its secret.

Leaked secrets do not support a rotation grace period. When you rotate one, the previous secret is discarded immediately. Update your services with the new secret, then re-enable the token.

For API rotations, omit previous_client_secret_expires_at. A future expiration returns 400. Attempting to re-enable the token before rotation returns 409.

For recovery steps and leak metadata fields, refer to Recover a leaked service token.