Cloudflare’s custom token screen is fine the first time. By the third rebuild, clicking through dozens of permission rows and doing it again for a second account, it stops being fine.
So we scripted it. One user-owned token that spans both of our Cloudflare accounts, minted from code, with the genuinely dangerous permissions (billing, user management, and token management) cut on purpose. Run it once, pipe the token straight into a secret store, done. One secret to store and rotate instead of one per account.
A couple of things made it worth writing up. A user-owned token can carry a separate policy per account, so you stop collecting a token per account. And there is a platform gotcha, error 1001, that turns out to enforce the exact security rule you wanted anyway: a scoped token is not allowed to mint another token that can manage tokens.
The full write-up walks through the method, the scoping rule, the 1001 gotcha, and the three checks that prove a fresh token actually works. It includes the whole script.
Read it over on Insights: One token, two accounts: minting Cloudflare API tokens from code.
If your Cloudflare or infrastructure access is a pile of hand-clicked tokens and you would rather have it defined in code, that is the kind of work we do here in the San Francisco Bay Area. Reach out.