Skip to content

Commit 649f3d0

Browse files
maxvpmaxvp
committed
Replace API token variable
1 parent 481ec43 commit 649f3d0

File tree

15 files changed

+168
-165
lines changed

15 files changed

+168
-165
lines changed

‎src/content/docs/cloudflare-one/connections/connect-devices/agentless/pac-files.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ https://<SUBDOMAIN>.proxy.cloudflare-gateway.com
6464

6565
```bash
6666
curl https://api.cloudflare.com/client/v4/accounts/<ACCOUNT_ID>/gateway/proxy_endpoints \
67-
--header "Authorization: Bearer <API_TOKEN>" \
67+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
6868
--header "Content-Type: application/json" \
6969
--data '{"name": "any_name", "ips": ["<PUBLIC_IP>", "<PUBLIC_IP2>", "<PUBLIC_IP3>"]}'
7070
```
@@ -212,7 +212,7 @@ To get the domain of a proxy endpoint:
212212

213213
```bash
214214
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/proxy_endpoints \
215-
--header "Authorization: Bearer <API_TOKEN>"
215+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
216216
```
217217

218218
```json {8} output

‎src/content/docs/cloudflare-one/connections/connect-networks/configure-tunnels/remote-management.mdx‎

Lines changed: 79 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -185,95 +185,98 @@ Cloudflare recommends rotating the tunnel token at a regular cadence to reduce t
185185

186186
To rotate a tunnel token:
187187

188-
1. Refresh the token on Cloudflare:
188+
1. Refresh the token on Cloudflare:
189189

190-
<Tabs syncKey="dashPlusAPI">
191-
<TabItem label="Dashboard">
190+
<Tabs syncKey="dashPlusAPI">
192191

193-
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Networks** > **Tunnels**.
194-
1. Select a `cloudflared` tunnel and select **Edit**.
195-
1. Select **Refresh token**.
196-
1. Copy the `cloudflared` installation command for your operating system. This command contains the new token.
192+
<TabItem label="Dashboard">
197193

198-
</TabItem>
199-
<TabItem label="API">
194+
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Networks** > **Tunnels**.
195+
1. Select a `cloudflared` tunnel and select **Edit**.
196+
1. Select **Refresh token**.
197+
1. Copy the `cloudflared` installation command for your operating system. This command contains the new token.
200198

201-
1. Generate a random base64 string (minimum size 32 bytes) to use as a tunnel secret:
202-
203-
```sh
204-
openssl rand -base64 32
205-
```
206-
207-
```sh output
208-
AQIDBAUGBwgBAgMEBQYHCAECAwQFBgcIAQIDBAUGBwg=
209-
```
210-
211-
2. Make a `PATCH` request to the [Cloudflare Tunnel](/api/resources/zero_trust/subresources/tunnels/methods/edit/) endpoint:
212-
213-
```sh
214-
curl --request PATCH \
215-
https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID \
216-
--header 'Content-Type: application/json' \
217-
--header "Authorization: Bearer <API_TOKEN>" \
218-
--data '{
219-
"name": "Example tunnel",
220-
"tunnel_secret": "AQIDBAUGBwgBAgMEBQYHCAECAwQFBgcIAQIDBAUGBwg="
221-
}'
222-
```
223-
224-
```sh output {18}
225-
{
226-
"success": true,
227-
"errors": [],
228-
"messages": [],
229-
"result": {
230-
"id": "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415",
231-
"account_tag": "699d98642c564d2e855e9661899b7252",
232-
"created_at": "2024-12-04T22:03:26.291225Z",
233-
"deleted_at": null,
234-
"name": "Example tunnel",
235-
"connections": [],
236-
"conns_active_at": null,
237-
"conns_inactive_at": "2024-12-04T22:03:26.291225Z",
238-
"tun_type": "cfd_tunnel",
239-
"metadata": {},
240-
"status": "inactive",
241-
"remote_config": true,
242-
"token": "eyJhIjoiNWFiNGU5Z..."
243-
}
244-
}
245-
```
246-
247-
3. Copy the `token` value shown in the output.
248-
249-
</TabItem>
250-
</Tabs>
199+
</TabItem>
251200

252-
After refreshing the token, `cloudflared` can no longer establish new connections to Cloudflare using the old token. However, existing connectors will remain active and the tunnel will continue serving traffic.
201+
<TabItem label="API">
253202

254-
1. On half of your `cloudflared` replicas, update `cloudflared` to use the new token. For example, on a Linux host:
203+
1. Generate a random base64 string (minimum size 32 bytes) to use as a tunnel secret:
255204

256-
```sh
257-
sudo cloudflared service install <TOKEN>
258-
```
205+
```sh
206+
openssl rand -base64 32
207+
```
259208

260-
1. Restart `cloudflared`:
209+
```sh output
210+
AQIDBAUGBwgBAgMEBQYHCAECAwQFBgcIAQIDBAUGBwg=
211+
```
261212

262-
```sh
263-
sudo systemctl restart cloudflared.service
264-
```
213+
2. Make a `PATCH` request to the [Cloudflare Tunnel](/api/resources/zero_trust/subresources/tunnels/methods/edit/) endpoint:
265214

266-
1. Confirm that the service started correctly:
215+
```sh
216+
curl --request PATCH \
217+
https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID \
218+
--header 'Content-Type: application/json' \
219+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
220+
--data '{
221+
"name": "Example tunnel",
222+
"tunnel_secret": "AQIDBAUGBwgBAgMEBQYHCAECAwQFBgcIAQIDBAUGBwg="
223+
}'
224+
```
267225

268-
```sh
269-
sudo systemctl status cloudflared
270-
```
226+
```sh output {18}
227+
{
228+
"success": true,
229+
"errors": [],
230+
"messages": [],
231+
"result": {
232+
"id": "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415",
233+
"account_tag": "699d98642c564d2e855e9661899b7252",
234+
"created_at": "2024-12-04T22:03:26.291225Z",
235+
"deleted_at": null,
236+
"name": "Example tunnel",
237+
"connections": [],
238+
"conns_active_at": null,
239+
"conns_inactive_at": "2024-12-04T22:03:26.291225Z",
240+
"tun_type": "cfd_tunnel",
241+
"metadata": {},
242+
"status": "inactive",
243+
"remote_config": true,
244+
"token": "eyJhIjoiNWFiNGU5Z..."
245+
}
246+
}
247+
```
248+
249+
3. Copy the `token` value shown in the output.
250+
251+
</TabItem>
252+
253+
</Tabs>
254+
255+
After refreshing the token, `cloudflared` can no longer establish new connections to Cloudflare using the old token. However, existing connectors will remain active and the tunnel will continue serving traffic.
256+
257+
1. On half of your `cloudflared` replicas, update `cloudflared` to use the new token. For example, on a Linux host:
258+
259+
```sh
260+
sudo cloudflared service install <TOKEN>
261+
```
262+
263+
1. Restart `cloudflared`:
264+
265+
```sh
266+
sudo systemctl restart cloudflared.service
267+
```
268+
269+
1. Confirm that the service started correctly:
270+
271+
```sh
272+
sudo systemctl status cloudflared
273+
```
271274

272-
While these replicas are connecting to Cloudflare with the new token, traffic will automatically route through the other replicas.
275+
While these replicas are connecting to Cloudflare with the new token, traffic will automatically route through the other replicas.
273276

274-
1. Wait 10 minutes for traffic to route through the new connectors.
277+
1. Wait 10 minutes for traffic to route through the new connectors.
275278

276-
1. Repeat steps 2, 3, and 4 for the second half of the replicas.
279+
1. Repeat steps 2, 3, and 4 for the second half of the replicas.
277280

278281
The tunnel token is now fully rotated. The old token is no longer in use.
279282

@@ -287,7 +290,7 @@ If your tunnel token is compromised, we recommend taking the following steps:
287290
```sh
288291
curl --request DELETE \
289292
https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID/connections \
290-
--header "Authorization: Bearer <API_TOKEN>"
293+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
291294
```
292295

293296
This will clean up any unauthorized connections and prevent users from connecting to your network.

‎src/content/docs/cloudflare-one/identity/idp-integration/entra-id.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -279,7 +279,7 @@ You can require users to re-enter their credentials into Entra ID whenever they
279279
```sh {17}
280280
curl --request PUT \
281281
https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/access/identity_providers/$IDENTITY_PROVIDER_ID \
282-
--header "Authorization: Bearer <API_TOKEN>" \
282+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
283283
--header "Content-Type: application/json" \
284284
--data '{
285285
"id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415",

‎src/content/docs/cloudflare-one/policies/access/policy-management.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ You can use the API to convert a legacy policy into a reusable policy. To conver
8383
```bash
8484
curl --request PUT \
8585
https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/access/apps/$APP_ID/policies/$POLICY_ID/make_reusable \
86-
--header "Authorization: Bearer <API_TOKEN>"
86+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
8787
```
8888

8989
The policy is now removed from the applications endpoint (`/access/apps/$APP_ID/policies`) and managed using the [reusable policies endpoints](/api/resources/zero_trust/subresources/access/subresources/policies/)(`/access/policies/$POLICY_ID`).

‎src/content/docs/cloudflare-one/policies/browser-isolation/isolation-policies.mdx‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ Isolate security threats such as malware and phishing.
136136
```bash
137137
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
138138
--header "Content-Type: application/json" \
139-
--header "Authorization: Bearer <API_TOKEN>" \
139+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
140140
--data '{
141141
"name": "Isolate all security threats",
142142
"description": "Isolate security threats such as malware and phishing",
@@ -170,7 +170,7 @@ Isolate high risk content categories such as newly registered domains.
170170
```bash
171171
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
172172
--header "Content-Type: application/json" \
173-
--header "Authorization: Bearer <API_TOKEN>" \
173+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
174174
--data '{
175175
"name": "Isolate high risk content",
176176
"description": "Isolate high risk content categories such as newly registered domains",
@@ -204,7 +204,7 @@ Isolate news and media sites, which are targets for malvertising attacks.
204204
```bash
205205
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
206206
--header "Content-Type: application/json" \
207-
--header "Authorization: Bearer <API_TOKEN>" \
207+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
208208
--data '{
209209
"name": "Isolate news and media",
210210
"description": "Isolate news and media sites, which are targets for malvertising attacks",
@@ -238,7 +238,7 @@ Isolate content that has not been categorized by [Cloudflare Radar](/radar/).
238238
```bash
239239
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
240240
--header "Content-Type: application/json" \
241-
--header "Authorization: Bearer <API_TOKEN>" \
241+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
242242
--data '{
243243
"name": "Isolate uncategorized content",
244244
"description": "Isolate content not categorized by Cloudflare Radar",
@@ -274,7 +274,7 @@ In **Configure policy settings**, you can customize restrictions for ChatGPT. Fo
274274
```bash
275275
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
276276
--header "Content-Type: application/json" \
277-
--header "Authorization: Bearer <API_TOKEN>" \
277+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
278278
--data '{
279279
"name": "Isolate ChatGPT",
280280
"description": "Isolate the use of ChatGPT",

‎src/content/docs/cloudflare-one/policies/gateway/dns-policies/common-policies.mdx‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ This policy allows users to access official corporate domains. By deploying the
3131
```bash
3232
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
3333
--header "Content-Type: application/json" \
34-
--header "Authorization: Bearer <API_TOKEN>" \
34+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
3535
--data '{
3636
"name": "Allow corporate domains",
3737
"description": "Allow any internal corporate domains added to a list",
@@ -94,7 +94,7 @@ You can implement policies to block websites hosted in countries categorized as
9494
```bash
9595
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
9696
--header "Content-Type: application/json" \
97-
--header "Authorization: Bearer <API_TOKEN>" \
97+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
9898
--data '{
9999
"name": "Block banned countries",
100100
"description": "Block access to banned countries",
@@ -129,7 +129,7 @@ Blocking [frequently misused](https://www.spamhaus.org/statistics/tlds/) top-lev
129129
```bash
130130
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
131131
--header "Content-Type: application/json" \
132-
--header "Authorization: Bearer <API_TOKEN>" \
132+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
133133
--data '{
134134
"name": "Block top-level domains",
135135
"description": "Block top-level domains that are frequently used for malicious practices",
@@ -163,7 +163,7 @@ To protect against [sophisticated phishing attacks](https://blog.cloudflare.com/
163163
```bash
164164
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
165165
--header "Content-Type: application/json" \
166-
--header "Authorization: Bearer <API_TOKEN>" \
166+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
167167
--data '{
168168
"name": "Block phishing attacks",
169169
"description": "Block attempts to phish specific domains targeting your organization",
@@ -198,7 +198,7 @@ To safeguard user privacy, some organizations will block tracking domains such a
198198
```bash
199199
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
200200
--header "Content-Type: application/json" \
201-
--header "Authorization: Bearer <API_TOKEN>" \
201+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
202202
--data '{
203203
"name": "Block online tracking",
204204
"description": "Block domains used for tracking at an OS level",
@@ -233,7 +233,7 @@ Block specific IP addresses that are known to be malicious or pose a threat to y
233233
```bash
234234
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
235235
--header "Content-Type: application/json" \
236-
--header "Authorization: Bearer <API_TOKEN>" \
236+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
237237
--data '{
238238
"name": "Block malicious IPs",
239239
"description": "Block specific IP addresses that are known to be malicious or pose a threat to your organization",
@@ -268,7 +268,7 @@ The CIPA (Children's Internet Protection Act) Filter is a collection of subcateg
268268
```bash
269269
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
270270
--header "Content-Type: application/json" \
271-
--header "Authorization: Bearer <API_TOKEN>" \
271+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
272272
--data '{
273273
"name": "Turn on CIPA filter",
274274
"description": "Block access to unwanted or harmful online content for children",
@@ -301,7 +301,7 @@ SafeSearch is a feature of search engines that helps you filter explicit or offe
301301
```bash
302302
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
303303
--header "Content-Type: application/json" \
304-
--header "Authorization: Bearer <API_TOKEN>" \
304+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
305305
--data '{
306306
"name": "Hide explicit search results",
307307
"description": "Force SafeSearch on search engines to filter explicit or offensive content",
@@ -335,7 +335,7 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
335335
```bash
336336
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
337337
--header "Content-Type: application/json" \
338-
--header "Authorization: Bearer <API_TOKEN>" \
338+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
339339
--data '{
340340
"name": "Check user identity",
341341
"description": "Filter traffic based on a user identity group name",
@@ -373,7 +373,7 @@ The following example includes two policies. The first policy allows the specifi
373373
```bash
374374
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
375375
--header "Content-Type: application/json" \
376-
--header "Authorization: Bearer <API_TOKEN>" \
376+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
377377
--data '{
378378
"name": "Allow social media for Marketing",
379379
"description": "Allow access to social media sites for users in the Marketing group",
@@ -405,7 +405,7 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
405405
```bash
406406
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
407407
--header "Content-Type: application/json" \
408-
--header "Authorization: Bearer <API_TOKEN>" \
408+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
409409
--data '{
410410
"name": "Block social media",
411411
"description": "Block social media for all other users",
@@ -448,7 +448,7 @@ Force users to connect with IPv4 by blocking IPv6 resolution.
448448
```bash
449449
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
450450
--header "Content-Type: application/json" \
451-
--header "Authorization: Bearer <API_TOKEN>" \
451+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
452452
--data '{
453453
"name": "Force IPv4",
454454
"description": "Force users to connect with IPv4 by blocking IPv6 resolution",
@@ -482,7 +482,7 @@ Force users to connect with IPv6 by blocking IPv4 resolution.
482482
```bash
483483
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
484484
--header "Content-Type: application/json" \
485-
--header "Authorization: Bearer <API_TOKEN>" \
485+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
486486
--data '{
487487
"name": "Force IPv6",
488488
"description": "Force users to connect with IPv6 by blocking IPv4 resolution",

0 commit comments

Comments
 (0)