API Shield’s JWT validation now accepts symmetric HMAC keys using the HS256, HS384, and HS512 algorithms. Engineers can therefore verify tokens with shared secrets instead of relying solely on asymmetric keys, while Cloudflare guarantees that the secret is never stored in plaintext.
Supported algorithms and configuration
- Three HMAC families are available:
HS256,HS384,HS512. - Keys can be entered through the Cloudflare dashboard or provisioned programmatically via the Cloudflare API.
- The documentation lists acceptable key formats and any credential length requirements.
Architectural considerations
- Switching to symmetric verification changes the trust model: the same secret must be known to both token issuer and API Shield.
- Because the secret is not persisted by Cloudflare, external secret‑management solutions remain responsible for storage and rotation.
- Systems that already use asymmetric keys can continue to do so; the new support is additive, not a replacement.
Operational and security implications
- Operators must protect the HMAC secret in transit and at rest, as Cloudflare will not retain a plaintext copy.
- Key rotation becomes a manual or automated process external to API Shield; the updated key must be redeployed to the dashboard or API.
- API responses deliberately omit the credential, reducing accidental exposure through debugging or logging.
Related CloudNinjas coverage: security.
What This Means For Practitioners
Evaluate whether a symmetric HMAC workflow fits your token‑issuance architecture and adjust secret‑management processes accordingly. Implement rotation policies that update both the issuer and API Shield configurations, and verify that your monitoring captures any mis‑configuration that could lead to token verification failures.
