Custody of credentials and scoped API tokens is what the Enterprise plan adds.
Two different things called a token
One is the connection’s own key — rotate and revoke covers that one. The other is a Cloudflare API token. Roles and permissions decides who may see either.
A control-plane connection key — the Ed25519 keypair the dashboard signs with. You hold the public half, and it is managed on the connection pane.
A Cloudflare API token — what the CLI and CI use to provision resources. Yours, minted with pithy token, stored outside every checkout at <config>/cloudflare.<name>.json, mode 0600.
They are unrelated. One is inbound; one is outbound.
No value is ever shown twice
And none is printed, logged, or put in an audit event by any command in the kit.
Which matters most in a browser, because a screen is a screenshot and a screenshot is forever.
Scoping down beats revoking late
Scopes are matched exactly — no prefix rule, no wildcard.
So a token for a CI job that only deploys does not need the scopes a token for a migration run has, and the narrower one is the one to mint.
Rotation, on the connection side
Append, prove, then expire. Two live keys is a normal state, not an exception.
The expire call must itself be signed with the successor — naming a live key is not proof you can sign with it.
Your Worker refuses an expiry that would leave no live key, because lockout is the one failure mode with no recovery path.
Revoking one leaked key
Does not need the whole connection rebuilt.
Revocation is checked before any validity window, so it takes effect on the next request — and it will take the last live key if you ask it to, because an adopter holding a leaked key must never be told they have to keep trusting it.
What no token here can do
Read a secret’s value. There is no route and no scope.
Erase an audit row.
Write to a balance ledger.
Impersonate a user.