OpenAI and Cloudflare Credentials Need an Expiry Plan

By Greg Nowak. Updated 16 October 2026.

An OpenAI key powers a useful automation. A Cloudflare token keeps deployments moving. Months later, someone asks who owns them, where they are used, or whether they can be replaced safely. The answers take longer than they should.

That uncertainty is a business dependency worth fixing. Every production credential needs an owner, a defined purpose, and a tested replacement procedure. An expiry date helps limit access, but the work has to happen before that date arrives.

Find out what would stop working

Start with one important integration. Identify every application, deployment workflow, scheduled task, and recovery script using its credential. Include agency systems and infrequent jobs: yesterday’s successful run tells you nothing about a monthly report.

Keep a shared inventory with the credential’s identifier, business purpose, owner and backup, permitted resources, consumers, secret storage location, expiry or review date, and replacement instructions. Record where the secret lives, never its value.

For agency work, agree who owns the provider account and who can issue replacements after handover. A client should not need a former supplier’s personal login to maintain its automation.

OpenAI: check whether GitHub Actions still needs a stored key

OpenAI supports exchanging a GitHub-issued identity token for a short-lived OpenAI access token. This can remove a long-lived API key from Actions secrets. Its official GitHub Actions federation guide provides the setup and SDK examples.

Create an OpenAI Workload Identity Provider and a mapping to the intended project’s service account. Match the issuer and audience exactly. Restrict the mapping by repository, Git ref, and workflow_ref, which identifies the workflow file and ref; include the environment when used. Narrow API permissions to the task.

The relevant GitHub job needs permission to request an identity token:

permissions:
  id-token: write
  contents: read

id-token: write allows token requests; it grants no repository write access. contents: read supports checkout. This YAML alone does not complete authentication: code must request and exchange the token. Follow GitHub’s OIDC guidance, including production environment protections.

Store provider ID, service-account ID, and audience as Actions variables. Keep tokens out of logs, separate build and production service accounts, and test before deleting the existing key.

Cloudflare: set permissions, ownership, and expiry deliberately

Give each automation access to the resources and operations it needs. A DNS reporting job needs read access; a DNS update job needs edit access. Review template permissions and select the specific zone. Consider an account-owned token when the required endpoints support it, so access is independent of an individual user. Cloudflare’s token creation guide covers these choices.

Cloudflare tokens have no expiry unless an end time is set. Dashboard dates mean 00:00 UTC at the start of the selected day; use the API for a precise time. Client IP restrictions can help, provided you know the runner’s outbound addresses. These details are documented under token restrictions.

For a user-owned token, check its status using the following command. Supply CLOUDFLARE_API_TOKEN through your secret store or protected environment:

curl "https://api.cloudflare.com/client/v4/user/tokens/verify" \
  --header "Authorization: Bearer ${CLOUDFLARE_API_TOKEN}"

An active status is only a preliminary check. It does not demonstrate the permissions needed by your automation, and Cloudflare excludes this endpoint from client IP filtering. Test the intended operation from the actual runner too.

Replace credentials in a controlled sequence

Expiry ends validity; rotation replaces the secret. Cloudflare’s Roll operation invalidates the previous secret while preserving access and permissions. Plan updates to consumers accordingly.

For routine replacement, I recommend a separate new credential with a brief, controlled overlap where supported:

1. Create and store the replacement. Check its permissions, resources, and lifetime before distributing it.
2. Update every consumer. Record whether each application needs a restart, redeployment, or fresh workflow run.
3. Exercise the real work. Validate the expected output, including infrequent tasks. A safe manual run may be better than waiting a month.
4. Revoke the old credential. Confirm operation afterwards, close the change record, and update the inventory.

Agree on recovery steps before starting. For a routine change, an unexpired old credential may offer temporary fallback. If compromise is suspected, revoke or roll it promptly and recover with fresh credentials.

Make the expiry plan someone’s job

Choose a lifetime the team can maintain, with reminders that leave time to investigate and test. As a starting schedule, assign a renewal task 30 days before expiry and escalate unresolved work seven days before it. Adjust those intervals to the credential’s lifetime and your release calendar.

For stored keys without a configured expiry, set a review date and a replacement task. A review date does not disable access. Recheck ownership whenever suppliers or team responsibilities change, and make failed scheduled jobs visible to the person responsible.

If your integrations feel too fragile to change, talk to Greg about a credential review. We can map dependencies, assess federation, and build a replacement procedure your team can use during normal operations and supplier handovers.

Related on GrN.dk

• WordPress 7.1 Exposes AI-Ready Actions. Who Gets to Run Them?
• Background AI Tasks Need Queues, Not Longer API Calls
• Cloudflare Service Keys Stop in September: Find Every Caller

Need help with this kind of work?

Discuss a credential review with Greg Get in touch with Greg.

Sources

• Configuring workload identity federation for GitHub Actions — OpenAI
• Configuring OpenID Connect in cloud providers — GitHub Docs
• Create API token — Cloudflare
• Restrict tokens — Cloudflare
• Roll tokens — Cloudflare