Skip to content
Baseworks KB

Cloudflare Credentials — Frictionless Access + VPS Cleanup

Created 2026-07-08
Status open
Tags projectinfrastructurecloudflarecredentialssecurity

Raised by Patrick 2026-07-08 during the July newsletter session. Two related workstreams, both deferred for a dedicated pass.

Problem

Section titled “Problem”
  • Interactive friction: Cloudflare API access currently runs through the 1Password CLI (op read). From Patrick’s Mac this works via the 1Password desktop-app integration (op read authorizes per call even though op whoami shows no persistent session), but it needs the app unlocked and is friction Patrick wants gone.
  • Stale VPS key: the agents VPS (baseworks-agents) still holds the old, rotated Cloudflare Global API Key in ~/.config/baseworks/vps-credentials (CF_API_KEY, CF_API_EMAIL, CF_ZONE_ID). The rotated key no longer authenticates — any headless purge from the VPS fails.

Workstream 1 — Mac-side frictionless access (Patrick to choose the method)

Section titled “Workstream 1 — Mac-side frictionless access (Patrick to choose the method)”

Keep a copy of the current Cloudflare API Token (scoped Bearer token, not the global key) on the Mac so it can be read instantly, with 1Password remaining the master copy. Options presented 2026-07-08:

  • macOS Keychain (security add-generic-password -A) — encrypted at rest, frictionless read, small risk of re-prompt after major OS updates. (Recommended balance.)
  • Local env file ~/.config/baseworks/cloudflare.env (600, gitignored) — simplest, never prompts, plaintext on disk (same model as the VPS vps-credentials).
  • 1Password service account (OP_SERVICE_ACCOUNT_TOKEN) — proper headless op, but the SA token still has to live in a local env file.

Decision: deferred — Patrick to pick the method.

Workstream 2 — VPS remediation (entangled; do together)

Section titled “Workstream 2 — VPS remediation (entangled; do together)”

Removing the stale key cleanly is not a one-line delete, because stale-cache-monitor (sites/baseworks-agents/scripts/stale-cache-monitor.sh, cron every 30 min) sources vps-credentials and purges via the global-key headers (X-Auth-Email/X-Auth-Key). The script runs set -uo pipefail, so simply deleting CF_API_KEY/CF_API_EMAIL would make it crash on the next purge (unbound variable). Steps:

  1. Add CF_API_TOKEN=<current scoped token> to ~/.config/baseworks/vps-credentials; remove CF_API_KEY and CF_API_EMAIL. Keep CF_ZONE_ID.
  2. Update the purge function in stale-cache-monitor.sh (in the changelog repo, then deploy via git pull on the VPS) to use -H "Authorization: Bearer ${CF_API_TOKEN}" instead of the two X-Auth-* headers.
  3. Test a purge from the VPS with the new token ("success":true).

This also fixes the monitor’s auto-purge, which has been silently failing since the global key was rotated.

Working reference (as of 2026-07-08)

Section titled “Working reference (as of 2026-07-08)”
  • CF API Token + zone IDs live in 1Password: Baseworks / “Cloudflare API - Baseworks Claude Code” (fields: credential, zone_id_baseworks_com, zone_id_baseworks_ca, zone_id_baseworks_jp). Token covers baseworks.com / .ca / .jp.
  • media.baseworks.com CDN purges use the baseworks.com zone.
  • Purge from Mac (current working method): op read the token → POST /zones/{zone}/purge_cache with Authorization: Bearer.
Section titled “Related”