---
title: "Cloudflare Service Key authentication removed from the API: 2026-09-30 | Harbyn"
description: "Cloudflare Service Key authentication removed from the API, effective Sep 30, 2026."
canonical: "https://harbyn.com/changes/cloudflare/2026-03-19-service-key-authentication-removal"
last-updated: 2026-10-08
---

# Cloudflare Service Key authentication removed from the API

Markdown version of <https://harbyn.com/changes/cloudflare/2026-03-19-service-key-authentication-removal>.

Retirement - Cloudflare. high severity. In effect. History: recorded after the fact.

Since September 30, 2026, the Cloudflare API no longer accepts requests authenticated with the X-Auth-User-Service-Key header. Use API Tokens instead; cloudflared versions from before November 2022 and older origin-ca-issuer versions still rely on Service Keys.

The deadline passed on Sep 30, 2026.

## Facts

| Fact | Value |
| --- | --- |
| Vendor | [Cloudflare](https://harbyn.com/vendors/cloudflare.md) |
| Kind | Retirement |
| Severity | high |
| Status | In effect |
| Announced | Mar 19, 2026 |
| Effective | Sep 30, 2026 |
| Added to Harbyn | Oct 8, 2026 |
| Lead time | Recorded after the fact: added 8 days after the deadline |
| Symbols | `X-Auth-User-Service-Key` |
| Review | Reviewed by a person, extracted by a model |

## Find it in your code

```sh
npx harbyn scan
```

This change names no identifier the scanner can match line by line, so the scan tells you whether your repository uses Cloudflare, from its packages and API hosts. Nothing leaves your machine.

## Sources

Where this event comes from: the page we read, when we read it, and the hash of that snapshot.

- <https://developers.cloudflare.com/fundamentals/api/reference/deprecations/> (deprecations, fetched 2026-10-08 17:16 UTC, sha256 `d7c038e2553509de3d70846a452398fc4acd4d5c7740643722821ae47e76cfb0`)

## Related changes

### More from Cloudflare

- [CIDR-encoded Zero Trust route endpoints and Tunnel connections field removed](https://harbyn.com/changes/cloudflare/2026-07-09-zero-trust-route-endpoints-and-tunnel-connections-field-changes.md) (Retirement, effective Oct 5, 2026)
- [Legacy Workers KV namespace API routes stop working October 15, 2026](https://harbyn.com/changes/cloudflare/2026-07-15-workers-kv-legacy-namespace-routes-reach-end-of-life.md) (Retirement, effective Oct 15, 2026)
- [Account creation API rejects names longer than 65 characters](https://harbyn.com/changes/cloudflare/2026-07-22-account-name-limit-enforcement.md) (Behavior change, effective Sep 27, 2026)
- [DNS settings API drops the foundation\_dns field on November 23, 2026](https://harbyn.com/changes/cloudflare/2026-07-27-foundation-dns-boolean-deprecated.md) (Retirement, effective Nov 23, 2026)

### Changes at other vendors

- [OpenRouter: arcee-ai/trinity-large-thinking expire 2026-10-26](https://harbyn.com/changes/openrouter/2026-10-23-arcee-ai-trinity-large-thinking-expires-2026-10-26.md) (effective Oct 26, 2026)
- [Google Cloud Run and Functions: Node.js 20 runtime decommission](https://harbyn.com/changes/google-cloud/2026-10-08-node-js-20-runtime-decommission.md) (effective Oct 30, 2026)
- [Mistral AI: Z.ai GLM 5.2 (zai-glm-5-2) retires on Mistral on October 31, 2026](https://harbyn.com/changes/mistral/2026-09-29-z-ai-glm-5-2-deprecated-and-scheduled-for-retirement.md) (effective Oct 31, 2026)
- [Fireworks AI: DeepSeek V4 Flash 0731 retires from Serverless Training November 2](https://harbyn.com/changes/fireworks/2026-10-18-upcoming-serverless-training-deprecation-deepseek-v4-flash-0731.md) (effective Nov 2, 2026)

[All upcoming deadlines](https://harbyn.com/deadlines.md)