Wrap your Cloudflare tokens in proxy tokens with IP restrictions and instant revocation — protect your DNS and CDN.
See how ShieldKey protects your Cloudflare integration with minimal code changes.
import Cloudflare from "cloudflare";
const cf = new Cloudflare({
apiToken: "cf-abc123..." // ← DNS and CDN access
});
const zones = await cf.zones.list();import Cloudflare from "cloudflare";
const cf = new Cloudflare({
apiToken: "sk_shield_t_2f8d..." // ← revocable proxy token
});
// Routes through proxy.shieldkey.io
const zones = await cf.zones.list();Disable any team member's access to your Cloudflare key in one click. No key rotation. No downtime. No re-deploying environment variables.
Set per-token spend caps so a compromised token can't run up your Cloudflare bill. Get alerts before limits are hit.
Restrict each shield token to specific IPs or CIDR ranges. Even if a token leaks, it's useless from unauthorized networks.
See every API call made through your Cloudflare key — who made it, when, from where, and what they accessed.
Your Cloudflare key is encrypted with AES-256-GCM. It's only decrypted in memory during request proxying — never stored in plaintext.
Issue individual shield tokens to each team member. When someone leaves, revoke their token — everyone else keeps working.
Add your Cloudflare key to ShieldKey's encrypted vault. ShieldKey generates a proxy token (starting with sk_shield_t_) that your team uses instead. Your real cf- key stays encrypted and is never exposed to team members.
Yes. Point your cloudflare SDK at proxy.shieldkey.io and use a shield token instead of your real API key. The SDK works identically — ShieldKey transparently proxies every request.
Revoke their shield token from the dashboard. Your real Cloudflare key stays active — no rotation, no downtime, no re-deploying secrets across services. Everyone else keeps working without interruption.
ShieldKey's proxy adds less than 25ms at the p50. The proxy decrypts your key in memory, forwards the request, and streams the response back. For most Cloudflare API calls, this overhead is negligible.
Set up ShieldKey in under 5 minutes. No credit card required.
Start Free