Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@ Track actions performed directly by users through Cloudflare interfaces (dashboa

- `actor_type="user"`: Action was performed by an individual user.
- `actor_type="Cloudflare_admin"`: Action was performed by Cloudflare.
- `actor_type="account"`: Action was performed using an account owned token. Refer to the [Account owned tokens](/fundamentals/api/get-started/account-owned-tokens/) documentation for more information.
- `actor_type="account"`: Action was performed using an account API token. Refer to the [Account API tokens](/fundamentals/api/get-started/account-owned-tokens/) documentation for more information.

#### System initiated Audit Logs

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ The account ID can be found via dashboard or API. For more information, refer to

:::note

Account owned API tokens are recommended for SCIM Provisioning. User owned API tokens, while supported, may result in a broken SCIM connection in the event when the user's policies are revoked from the SCIM integration, or the [API access](/fundamentals/api/how-to/control-api-access/) is unexpectedly disabled. Learn more about [account owned tokens](/fundamentals/api/get-started/account-owned-tokens/).
Account API tokens are recommended for SCIM Provisioning. User owned API tokens, while supported, may result in a broken SCIM connection in the event when the user's policies are revoked from the SCIM integration, or the [API access](/fundamentals/api/how-to/control-api-access/) is unexpectedly disabled. Learn more about [Account API tokens](/fundamentals/api/get-started/account-owned-tokens/).
:::

2. Under **Account Resources**, select the specific account to include or exclude from the dropdown menu, if applicable.
Expand Down
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
---
title: Account owned tokens
title: Account API tokens
pcx_content_type: how-to
sidebar:
order: 6
head: []
description: Learn what account owned tokens are, when to use them, and what they currently work with
description: Learn what account API tokens are, when to use them, and what they currently work with

---

While user tokens act on behalf of a particular user and inherit a subset of that user's permissions, account owned tokens allow you to set up durable integrations that can act as service principals with their own specific set of permissions. This approach is ideal for scenarios like CI/CD, or building integrations with external services like SEIMs where it is important that the integration continues working, even long after the user who configured the integration may have left your organization altogether. User tokens are better for ad hoc tasks like scripting, where acting as the user is ideal and durability is less of a concern.
While user tokens act on behalf of a particular user and inherit a subset of that user's permissions, account API tokens allow you to set up durable integrations that can act as service principals with their own specific set of permissions. This approach is ideal for scenarios like CI/CD, or building integrations with external services like SEIMs where it is important that the integration continues working, even long after the user who configured the integration may have left your organization altogether. User tokens are better for ad hoc tasks like scripting, where acting as the user is ideal and durability is less of a concern.

## Create an account owned token

Expand All @@ -22,13 +22,13 @@ Creating an account owned token requires Super Administrator permission on the a
4. Select **Continue to summary** and review the details.
5. Select **Create Token**.

Alternatively, you can create a token using the [account owned token creation API](/api/resources/accounts/subresources/tokens/methods/create/).
Alternatively, you can create a token using the [account API token creation API](/api/resources/accounts/subresources/tokens/methods/create/).

Refer to the [blog post](https://blog.cloudflare.com/account-owned-tokens-automated-actions-zaraz/) for more information.

## Compatibility matrix

Account owned tokens are generally available for all accounts. Some services may not support account owned tokens yet. Refer to the compatibility matrix below for the latest status.
Account API tokens are generally available for all accounts. Some services may not support account API tokens yet. Refer to the compatibility matrix below for the latest status.

| Product | Compatibility |
| ------------------------------- | ------------- |
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ Before you begin, [find your zone and account IDs](/fundamentals/account/find-ac

:::

1. Determine if you want a user token or an [Account owned token](/fundamentals/api/get-started/account-owned-tokens/). Use Account owned tokens if you prefer service tokens that are not associated with users and your [desired API endpoints are compatible](/fundamentals/api/get-started/account-owned-tokens/#compatibility-matrix).
1. Determine if you want a user token or an [Account API token](/fundamentals/api/get-started/account-owned-tokens/). Use Account API tokens if you prefer service tokens that are not associated with users and your [desired API endpoints are compatible](/fundamentals/api/get-started/account-owned-tokens/#compatibility-matrix).
2. From the [Cloudflare dashboard](https://dash.cloudflare.com/profile/api-tokens/), go to **My Profile** > **API Tokens** for user tokens. For Account Tokens, go to **Manage Account** > **API Tokens**.
3. Select **Create Token**.
4. Select a template from the available [API token templates](/fundamentals/api/reference/template/) or create a custom token. The following example uses the **Edit zone DNS** template.
Expand Down
Loading