Cloudflare API Tokens: Unresolved behavior of expires_on expiration enforcement

Direct Answers

1. New requests after expiration: The API gateway is designed to reject requests with a 401 Unauthorized or 403 Forbidden once the current UTC time passes the expires_on timestamp. This is the intended enforcement behavior.
2. Cached credentials in Workers/Edge: Cloudflare Workers do not automatically refresh or rotate API tokens. If a token is stored in a Worker environment variable, KV, or secret, the Worker will continue sending the expired token until you update the stored value and redeploy. Edge caching of the token itself does not bypass the gateway's server-side expiration check.
3. /user/tokens/verify endpoint: This endpoint should reflect the token's expired status. If it continues to return "active" after the expiration timestamp, that indicates a discrepancy between the verification logic and the gateway enforcement—a known gap that warrants verification.

Confirmed vs. Likely Behavior

Aspect	Confirmed (Documented/Observed)	Likely / Requires Verification
Gateway rejection after expires_on	Design intent per Cloudflare architecture	Exact HTTP code (401 vs 403) and error body
Propagation delay	Global edge propagation can take seconds to minutes	Maximum observed delay in production
Worker token handling	No auto-refresh; manual update required	Whether Workers KV TTL interacts with token expiry
/user/tokens/verify accuracy	Intended to show current status	Whether it lags behind gateway enforcement

Minimal Verification Procedure

Run this once to confirm behavior in your account:

1. Create a test API token with expires_on set to 5 minutes in the future (UTC). Scope it to a low-risk permission like Zone:Read.
2. Immediately call a protected endpoint (e.g., GET /client/v4/zones) and record the response code.
3. Wait until 1–2 minutes past the expires_on time, then repeat the same request.
4. Call GET /user/tokens/verify with the same token after expiration and note the status field.

# Example verification calls (replace TOKEN and ZONE_ID)
curl -H "Authorization: Bearer TOKEN" \
  "https://api.cloudflare.com/client/v4/zones"

curl -H "Authorization: Bearer TOKEN" \
  "https://api.cloudflare.com/client/v4/user/tokens/verify"

One Diagnostic Detail Needed

If the verification shows the token is still accepted or /user/tokens/verify returns "active" after expiration, please report the exact expires_on value you set and the UTC time you observed the behavior. That timestamp precision determines whether the issue is propagation delay or a logic gap.

Operational Recommendation

• Treat expires_on as enforced at the gateway, but plan for a propagation window of up to a few minutes.
• Rotate tokens proactively (e.g., via API or Terraform) before expiry; do not rely on Workers to self-heal.
• Monitor /user/tokens/verify in automation only as a supplementary signal—gate on actual 401/403 responses from protected endpoints.