--- title: Token Validation --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Token Validation #### Token ValidationConfiguration ##### [List token validation configurations](https://developers.cloudflare.com/api/resources/token_validation/subresources/configuration/methods/list) GET/zones/{zone\_id}/token\_validation/config ##### [Get a token validation configuration](https://developers.cloudflare.com/api/resources/token_validation/subresources/configuration/methods/get) GET/zones/{zone\_id}/token\_validation/config/{config\_id} ##### [Create a token validation configuration](https://developers.cloudflare.com/api/resources/token_validation/subresources/configuration/methods/create) POST/zones/{zone\_id}/token\_validation/config ##### [Edit a token validation configuration](https://developers.cloudflare.com/api/resources/token_validation/subresources/configuration/methods/edit) PATCH/zones/{zone\_id}/token\_validation/config/{config\_id} ##### [Delete a token validation configuration](https://developers.cloudflare.com/api/resources/token_validation/subresources/configuration/methods/delete) DELETE/zones/{zone\_id}/token\_validation/config/{config\_id} ##### ModelsExpand Collapse

TokenConfig object {id, created\_at, credentials, 5 more }

id: string UUID. maxLength36 minLength36 Link to this property created\_at: string formatdate-time Link to this property

credentials: object {keys }

keys: array of object {alg, e, kid, 2 more } or object {alg, crv, kid, 3 more } or object {alg, crv, kid, 3 more } or object {alg, kid, kty }

One of the following:

APIShieldCredentialsJWTKeyRSA object {alg, e, kid, 2 more } JSON representation of an RSA key.

alg: "RS256"or "RS384"or "RS512"or 3 more Algorithm

One of the following: "RS256" Link to this property "RS384" Link to this property "RS512" Link to this property "PS256" Link to this property "PS384" Link to this property "PS512" Link to this property

Link to this property e: string RSA exponent Link to this property kid: string Key ID Link to this property kty: "RSA" Key Type Link to this property n: string RSA modulus Link to this property

Link to this property

APIShieldCredentialsJWTKeyEcEs256 object {alg, crv, kid, 3 more } JSON representation of an ES256 key

alg: "ES256" Algorithm Link to this property crv: "P-256" Curve Link to this property kid: string Key ID Link to this property kty: "EC" Key Type Link to this property x: string X EC coordinate Link to this property y: string Y EC coordinate Link to this property

Link to this property

APIShieldCredentialsJWTKeyEcEs384 object {alg, crv, kid, 3 more } JSON representation of an ES384 key

alg: "ES384" Algorithm Link to this property crv: "P-384" Curve Link to this property kid: string Key ID Link to this property kty: "EC" Key Type Link to this property x: string X EC coordinate Link to this property y: string Y EC coordinate Link to this property

Link to this property

APIShieldCredentialsJWTKeyOctResponse object {alg, kid, kty } JSON representation of a symmetric verification key in API responses (secret material is redacted).

alg: "HS256"or "HS384"or "HS512" Algorithm

One of the following: "HS256" Link to this property "HS384" Link to this property "HS512" Link to this property

Link to this property kid: string Key ID Link to this property kty: "oct" Key Type Link to this property

Link to this property

Link to this property description: string maxLength500 Link to this property last\_updated: string formatdate-time Link to this property title: string maxLength50 Link to this property token\_sources: array of string Link to this property token\_type: "JWT" Link to this property

[Link to this property](<#(resource)%20token_validation.configuration%20%3E%20(model)%20token_config%20%3E%20(schema)>)

ConfigurationEditResponse object {id, description, title, token\_sources }

id: optional string UUID. maxLength36 minLength36 Link to this property description: optional string maxLength500 Link to this property title: optional string maxLength50 Link to this property token\_sources: optional array of string Link to this property

[Link to this property](<#(resource)%20token_validation.configuration%20%3E%20(model)%20configuration_edit_response%20%3E%20(schema)>)

ConfigurationDeleteResponse object {id }

id: optional string UUID. maxLength36 minLength36 Link to this property

[Link to this property](<#(resource)%20token_validation.configuration%20%3E%20(model)%20configuration_delete_response%20%3E%20(schema)>) #### Token ValidationConfigurationCredentials ##### [Replace token validation credentials](https://developers.cloudflare.com/api/resources/token_validation/subresources/configuration/subresources/credentials/methods/update) PUT/zones/{zone\_id}/token\_validation/config/{config\_id}/credentials ##### [Edit token validation credentials](https://developers.cloudflare.com/api/resources/token_validation/subresources/configuration/subresources/credentials/methods/edit) PATCH/zones/{zone\_id}/token\_validation/config/{config\_id}/credentials ##### ModelsExpand Collapse

CredentialUpdateResponse object {keys }

keys: array of object {alg, e, kid, 2 more } or object {alg, crv, kid, 3 more } or object {alg, crv, kid, 3 more } or object {alg, kid, kty }

One of the following:

APIShieldCredentialsJWTKeyRSA object {alg, e, kid, 2 more } JSON representation of an RSA key.

alg: "RS256"or "RS384"or "RS512"or 3 more Algorithm

Link to this property e: string RSA exponent Link to this property kid: string Key ID Link to this property kty: "RSA" Key Type Link to this property n: string RSA modulus Link to this property

Link to this property

APIShieldCredentialsJWTKeyEcEs256 object {alg, crv, kid, 3 more } JSON representation of an ES256 key

Link to this property

APIShieldCredentialsJWTKeyEcEs384 object {alg, crv, kid, 3 more } JSON representation of an ES384 key

Link to this property

APIShieldCredentialsJWTKeyOctResponse object {alg, kid, kty } JSON representation of a symmetric verification key in API responses (secret material is redacted).

alg: "HS256"or "HS384"or "HS512" Algorithm

One of the following: "HS256" Link to this property "HS384" Link to this property "HS512" Link to this property

Link to this property kid: string Key ID Link to this property kty: "oct" Key Type Link to this property

Link to this property

[Link to this property](<#(resource)%20token_validation.configuration.credentials%20%3E%20(model)%20credential_update_response%20%3E%20(schema)>)

CredentialEditResponse object {keys }

keys: array of object {alg, e, kid, 2 more } or object {alg, crv, kid, 3 more } or object {alg, crv, kid, 3 more } or object {alg, kid, kty }

One of the following:

APIShieldCredentialsJWTKeyRSA object {alg, e, kid, 2 more } JSON representation of an RSA key.

alg: "RS256"or "RS384"or "RS512"or 3 more Algorithm

Link to this property e: string RSA exponent Link to this property kid: string Key ID Link to this property kty: "RSA" Key Type Link to this property n: string RSA modulus Link to this property

Link to this property

APIShieldCredentialsJWTKeyEcEs256 object {alg, crv, kid, 3 more } JSON representation of an ES256 key

Link to this property

APIShieldCredentialsJWTKeyEcEs384 object {alg, crv, kid, 3 more } JSON representation of an ES384 key

Link to this property

APIShieldCredentialsJWTKeyOctResponse object {alg, kid, kty } JSON representation of a symmetric verification key in API responses (secret material is redacted).

alg: "HS256"or "HS384"or "HS512" Algorithm

One of the following: "HS256" Link to this property "HS384" Link to this property "HS512" Link to this property

Link to this property kid: string Key ID Link to this property kty: "oct" Key Type Link to this property

Link to this property

[Link to this property](<#(resource)%20token_validation.configuration.credentials%20%3E%20(model)%20credential_edit_response%20%3E%20(schema)>) #### Token ValidationRules ##### [List token validation rules](https://developers.cloudflare.com/api/resources/token_validation/subresources/rules/methods/list) GET/zones/{zone\_id}/token\_validation/rules ##### [Create a token validation rule](https://developers.cloudflare.com/api/resources/token_validation/subresources/rules/methods/create) POST/zones/{zone\_id}/token\_validation/rules ##### [Create token validation rules](https://developers.cloudflare.com/api/resources/token_validation/subresources/rules/methods/bulk_create) POST/zones/{zone\_id}/token\_validation/rules/bulk ##### [Edit token validation rules](https://developers.cloudflare.com/api/resources/token_validation/subresources/rules/methods/bulk_edit) PATCH/zones/{zone\_id}/token\_validation/rules/bulk ##### [Get a token validation rule](https://developers.cloudflare.com/api/resources/token_validation/subresources/rules/methods/get) GET/zones/{zone\_id}/token\_validation/rules/{rule\_id} ##### [Delete a token validation rule](https://developers.cloudflare.com/api/resources/token_validation/subresources/rules/methods/delete) DELETE/zones/{zone\_id}/token\_validation/rules/{rule\_id} ##### [Edit a token validation rule](https://developers.cloudflare.com/api/resources/token_validation/subresources/rules/methods/edit) PATCH/zones/{zone\_id}/token\_validation/rules/{rule\_id} ##### ModelsExpand Collapse

TokenValidationRule object {action, description, enabled, 6 more } A Token Validation rule that can enforce security policies using JWT Tokens.

action: "log"or "block" Action to take on requests that match operations included in selector and fail expression.

One of the following: "log" Link to this property "block" Link to this property

Link to this property description: string A human-readable description that gives more details than title. maxLength500 Link to this property enabled: boolean Toggle rule on or off. Link to this property expression: string Rule expression. Requests that fail to match this expression will be subject to action. For details on expressions, see the Cloudflare Docs. Link to this property

selector: object {exclude, include } Select operations covered by this rule. For details on selectors, see the Cloudflare Docs.

exclude: optional array of object {operation\_ids } Ignore operations that were otherwise included by include.

operation\_ids: optional array of string Excluded operation IDs. Link to this property

Link to this property

include: optional array of object {host } Select all matching operations.

host: optional array of string Included hostnames. Link to this property

Link to this property

Link to this property title: string A human-readable name for the rule. maxLength50 Link to this property id: optional string UUID. maxLength36 minLength36 Link to this property created\_at: optional string formatdate-time Link to this property last\_updated: optional string formatdate-time Link to this property

[Link to this property](<#(resource)%20token_validation.rules%20%3E%20(model)%20token_validation_rule%20%3E%20(schema)>) RuleDeleteResponse = unknown [Link to this property](<#(resource)%20token_validation.rules%20%3E%20(model)%20rule_delete_response%20%3E%20(schema)>)