Cloudflare.TokenValidation reference

TokenConfiguration

Source: src/Cloudflare/TokenValidation/Configuration.ts

An API Shield JWT validation token configuration — the JWKS key material and token source locations used to validate JSON Web Tokens on a zone.

A configuration holds a set of public JWKs (keys) plus the request fields where the token is found (tokenSources). Rules (Rule) then reference the configuration by UUID in their expression (e.g. is_jwt_valid("<configId>")) to enforce validation on selected hosts/operations.

JWT validation is an API Shield feature (Enterprise add-on) — accounts without the entitlement receive the typed TokenValidationNotEntitled error (Cloudflare code 10403) on every call.

Title, description, and token sources are patched in place; the key set is rotated in place via the credentials endpoint. Only zoneId and tokenType force a replacement.

TokenConfiguration: Creating a Configuration

const config = yield* Cloudflare.TokenValidation.TokenConfiguration("ApiJwt", {
  zoneId: zone.zoneId,
  tokenSources: ['http.request.headers["authorization"][0]'],
  keys: [
    {
      kty: "RSA",
      alg: "RS256",
      kid: "key-2026-01",
      n: "<base64url modulus>",
      e: "AQAB",
    },
  ],
});

TokenConfiguration: Rotating Keys

// Changing `keys` PUTs the full key set to the credentials endpoint —
// the configuration (and its UUID) stays in place.
const config = yield* Cloudflare.TokenValidation.TokenConfiguration("ApiJwt", {
  zoneId: zone.zoneId,
  tokenSources: ['http.request.headers["authorization"][0]'],
  keys: [oldKey, newKey],
});

TokenConfiguration: Enforcing Validation

yield* Cloudflare.TokenValidation.Rule("RequireJwt", {
  zoneId: zone.zoneId,
  action: "block",
  expression: Output.interpolate`is_jwt_valid("${config.configId}")`,
  selector: { include: [{ host: ["api.example.com"] }] },
});

Rule

Source: src/Cloudflare/TokenValidation/Rule.ts

An API Shield JWT validation rule — selects operations/hosts on a zone and enforces a token validation expression with a log or block action.

A rule references a TokenConfiguration by UUID inside its expression (e.g. is_jwt_valid("<configId>")). Keep the rule depending on the configuration through its output so destroy order is rule first, configuration second.

JWT validation is an API Shield feature (Enterprise add-on) — accounts without the entitlement receive the typed TokenValidationNotEntitled error (Cloudflare code 10403) on every call.

All fields are patched in place; only zoneId forces a replacement.

Rule: Creating a Rule

Log requests with invalid JWTs

const rule = yield* Cloudflare.TokenValidation.Rule("LogInvalidJwt", {
  zoneId: zone.zoneId,
  action: "log",
  expression: Output.interpolate`is_jwt_valid("${config.configId}")`,
  selector: { include: [{ host: ["api.example.com"] }] },
});

Block invalid JWTs, excluding a public operation

yield* Cloudflare.TokenValidation.Rule("BlockInvalidJwt", {
  zoneId: zone.zoneId,
  action: "block",
  expression: Output.interpolate`is_jwt_valid("${config.configId}")`,
  selector: {
    include: [{ host: ["api.example.com"] }],
    exclude: [{ operationIds: [healthCheck.operationId] }],
  },
});

Rule: Updating a Rule

yield* Cloudflare.TokenValidation.Rule("BlockInvalidJwt", {
  zoneId: zone.zoneId,
  enabled: false,
  action: "block",
  expression: Output.interpolate`is_jwt_valid("${config.configId}")`,
  selector: { include: [{ host: ["api.example.com"] }] },
});