Summary
Cloudflare Access service-token Client Secrets created on or after August 26, 2026 use a new format — cfast_ followed by 40 alphanumeric characters and an 8-character checksum. The identifiable prefix and checksum make the credentials far easier for secret-scanning tools to detect with fewer false positives.
What changed
New Cloudflare Access service-token Client Secrets now carry a cfast_ prefix plus a checksum, giving them a recognizable, verifiable shape for secret scanners.
Why it matters
Machine-to-machine and agent identities increasingly run on service tokens; a structured, checksummed secret format makes leaked credentials detectable in code and logs, reducing the blast radius of accidental exposure. It is a small but concrete hardening of non-human identity plumbing.
Evidence excerpt
Cloudflare Access service token Client Secrets created on or after August 26, 2026, use the format cfast_[40 alphanumeric characters][8-character checksum].