Purge zone cache via API with X-Auth-User-Service-Key


I’d like to have a script-based API call thru cURL to purge a zone’s cache or to switch developer mode.
As I do not want to hard-code my X-Auth-Key key and X-Auth-Email do to security concerns (anyone with read access to the code would be able to take over the Cloudflare account!), this as far as I understand can also be done by using a User-Service-Key that applied only to this endpoint.

But… where can I find the User-Service-Key for the resource? Is this only available for some certificate actions like explained in the API documentation?

Maybe I’m missing something. Is there any safe way to achieve this?


You can currently only purge cache with global API keys. Its a very much requested feature to have the ability to create restricted keys, but unfortunately there hasn’t been much news on this lately.

A while ago I wrote a service worker that proxies calls to the purge cache endpoint. It is one way to limit the exposure of global keys. Perhaps you will find it useful:

Thank you Martin, this indeed looks great. Thanks for sharing!