contrib/cloudflare.php: service_key auth no longer works (Cloudflare removed it on 2026-09-30)

[otisz22]

Deployer Version: master at c08d136; the same code is in v8.0.5.

Target OS: any (Cloudflare API side change, not OS specific)

PHP version: any (not PHP version specific)

Steps to reproduce

1. Configure the deploy:cloudflare recipe with cloudflare.service_key (plus zone_id or domain).
2. Run deploy:cloudflare.

Cloudflare removed Service Key authentication on September 30, 2026. From the Cloudflare API deprecations page, entry "Service Key Authentication", deprecation date March 19, 2026, End of life date September 30, 2026 (source):

Service Key authentication for the Cloudflare API is deprecated and will be removed on September 30, 2026.

with deprecated behavior "Authenticating API requests using the X-Auth-User-Service-Key header" and replacement "Create an API Token with the appropriate permissions for your use case."

In contrib/cloudflare.php:

• lines 29-31: service_key is checked first and wins over the other options, so a config with a leftover service_key sends only X-Auth-User-Service-Key, even if api_token is also set.
• line 91: the purge_cache response is not inspected (only curl transport errors throw), so with zone_id set the task finishes as if the purge worked. With only domain set, the zone lookup would fail with "Problem with zone data".
• line 7 (docs block) still recommends service_key, and the error at line 43 says "Set a service key or email / api key".

I have not run this against the live API; this is from reading the recipe against the Cloudflare change above.

Suggested change

• Drop the service_key branch, or make it throw a clear message such as "Cloudflare removed service keys on 2026-09-30, use api_token".
• Update the docs block and the line 43 message to point to api_token.
• Optionally decode the purge response and throw when success is false, so a failed purge is visible in the deploy log.

---

I found this with a small scanner I'm building that checks public repos against upcoming platform deadlines (https://otisz.hu/api-sunset/). No sales pitch: happy to open a PR if you want one.

Ottó Misák

[xop01]

Cloudflare removed the old service key style auth; API calls that still send X-Auth-Service-Key (or the contrib recipe that uses it) will fail after their cutoff.

Fix direction:

1. Use a Cloudflare API token with the minimum permissions for DNS or cache purge (whatever the recipe needs).
2. Update contrib/cloudflare.php (or your deploy script) to use the token header Cloudflare documents today, not the legacy service key fields.
3. Store the token in CI secrets / .env, not in the repo.

Until the contrib file is updated upstream, a local copy of the recipe with token auth is the usual workaround.

@otisz22