“Cloudflare Rejected the API Token” — Five Causes, Five Fixes

Symptoms

You probably have this issue if all of the following match:

Verify It’s a 401/403 (Not a 404 or 429)

One curl test from any terminal confirms which HTTP code Cloudflare is returning for your token. Run this from your own machine (not your WP server) — macOS, Linux, Windows PowerShell, and WSL all work. Substitute your actual token + Zone ID in place of the placeholders:

curl -s -o /dev/null -w "%{http_code}\n" \
  -H "Authorization: Bearer <your-token>" \
  -H "Content-Type: application/json" \
  https://api.cloudflare.com/client/v4/zones/<your-zone-id>

The number printed is the HTTP status code Cloudflare returned:

Cause 1 — Copy/Paste Truncation

The most common cause. Cloudflare’s tokens are long enough that a stray click, double-click selection, or autoclose dialog can truncate the string in the clipboard. Symptom: the verify curl returns 401.

How to confirm

Cloudflare API tokens are a single long alphanumeric string (no dashes, no underscores, no spaces). Open ForgeCache → Settings → Advanced, click in the API Token field, and use your browser’s Inspect tool to view the actual saved value (Right-click the field → Inspect → the value attribute shows the full string regardless of the password mask). If it looks notably shorter than what you originally copied from Cloudflare, you’ve got truncation.

The fix

Cause 2 — Pasted the Global API Key Instead of a Scoped Token

Cloudflare has two distinct credential systems. The Global API Key is the older, account-wide secret used for direct API access — it has access to everything on your account (DNS, billing, zone transfers, the lot). The API Tokens system is the newer, scoped credential pattern — one token, one permission, one zone.

ForgeCache supports API Tokens only. The Global API Key uses a different auth header format (X-Auth-Email + X-Auth-Key instead of Authorization: Bearer) and ForgeCache will not authenticate with it. If you pasted the Global API Key by mistake, every call returns 401.

How to confirm

Open dash.cloudflare.com/profile/api-tokens. On the same dashboard page there’s a separate API Keys area (its exact location may differ in the redesigned UI — it’s the section that exposes the Global API Key + Origin CA Key). If the value you pasted into ForgeCache is from API Keys rather than API Tokens — especially the Global API Key — that’s the wrong credential.

The fix

Create a proper scoped API token. The Step 1 of the setup walkthrough covers this in detail. The short version:

Cause 3 — Missing or Wrong Permission

You created a scoped token, but the permission isn’t Cache → Purge on the right zone. Common variants:

• Scoped to Entire Account instead of Specific zone
• Permission is something else under Cache & Performance (like Cache Settings — Read)
• Permission is correct but scoped to the wrong zone (a different domain on your CF account)

How to confirm

Cloudflare doesn’t let you see a token’s configuration after creation through the dashboard list view — but you can use the token itself to ask Cloudflare what it’s allowed to do. Substitute your token in place of the placeholder:

curl -s -H "Authorization: Bearer <your-token>" \
  https://api.cloudflare.com/client/v4/user/tokens/verify

The response includes a JSON block that lists the token’s policies. If you see no Cache Purge policy, or the scope is wrong, the permission is the cause.

The fix

You can’t edit a token’s permissions after creation — you have to delete it and create a fresh one. Follow Step 1 of the setup walkthrough, paying particular attention to:

• Scope must be Specific zone, not Entire Account — otherwise Cache Purge doesn’t appear.
• Permission must be Cache → Purge, not Cache Settings — Cache Settings is read-only and gives the wrong rights.
• Zone selection must match the Zone ID you pasted into ForgeCache — if you have multiple domains on your Cloudflare account, you need a token scoped to this domain’s zone.

Cause 4 — Token Expired or Revoked

When you create a Cloudflare API token, you can set an expiration date or pick No expiration. If you picked an expiration that has now passed, the token returns 401 on every call from then on. Tokens can also be deleted (revoked) from the API Tokens page — you, another admin on your CF account, or a security cleanup script could have done this.

How to confirm

Open dash.cloudflare.com/profile/api-tokens. Find your ForgeCache token in the list. Each row shows status: Active, Expired, or the token may simply be absent (revoked). The status will tell you which.

The fix

Both cases resolve the same way — you need a fresh token. Two paths:

If the token is shown as Expired:

Open the actions menu on the token row and choose Roll (sometimes labeled Regenerate). Cloudflare issues a new value with the same permissions, but you choose a new expiration. Set No expiration if you don’t want to deal with this again, or pick a duration you’ll actually remember to renew.

If the token is missing entirely (revoked):

Create a fresh token following Step 1 of the setup walkthrough. Paste into ForgeCache, save, retest.

Cause 5 — Whitespace Contamination

An invisible space, tab, or newline got into the API Token field on paste. This is unusual but happens when copying from certain browser dialog boxes that put a trailing newline on the clipboard. ForgeCache trims whitespace from both ends of the value on save, but a stray character inside the token (which can happen if you re-edited the field after pasting) breaks authentication while looking visually correct.

How to confirm

The simplest check: in the verify curl from earlier, the token worked (returned 200), but the ForgeCache test still fails. That mismatch means the saved value differs from what you just curled with.

The fix

Still Stuck? Email Priority Support

If you’ve worked through all five causes and the token is still being rejected:

Email support@royalplugins.com with the diagnostic info below. Priority email support is included with your ForgeCache Pro license — typical response time is within 24 hours.