use API Token in favour of API Key for better security

.env.example

@@ -1,6 +1,5 @@
-CLOUDFLARE_API_KEY=
+CLOUDFLARE_API_TOKEN=
 CLOUDFLARE_ACCOUNT_ID=
-CLOUDFLARE_ACCOUNT_EMAIL=
 CLOUDFLARE_LIST_ITEM_LIMIT=300000
 DRY_RUN=0
 FAST_MODE=0

README.md

@@ -51,9 +51,8 @@ Please note that the GitHub Action downloads the recommended blocklists and whit
 1. Create a new empty, private repository. Forking or public repositories are discouraged, but supported - although the script never leaks your API keys and GitHub Actions secrets are automatically redacted from the logs, it's better to be safe than sorry.
 2. Create the following GitHub Actions secrets in your repository settings:
 
-- `CLOUDFLARE_API_KEY`: Your Cloudflare API key
+- `CLOUDFLARE_API_TOKEN`: Your Cloudflare API Token with Zero Trust read and write permissions
 - `CLOUDFLARE_ACCOUNT_ID`: Your Cloudflare account ID
-- `CLOUDFLARE_ACCOUNT_EMAIL`: Your Cloudflare account email
 - `CLOUDFLARE_LIST_ITEM_LIMIT`: The maximum number of blocked domains allowed for your Cloudflare Zero Trust plan. Use 300000 for the free plan or if you're unsure.
 - `PING_URL`: /Optional/ The HTTP(S) URL to ping (using curl) after the GitHub Action has successfully updated your filters. Useful for monitoring.
 

auto_update_github_action.yml

@@ -46,8 +46,7 @@ jobs:
       - name: Delete old rules and lists
         run: npm run cloudflare-delete
         env:
-          CLOUDFLARE_API_KEY: ${{ secrets.CLOUDFLARE_API_KEY }}
-          CLOUDFLARE_ACCOUNT_EMAIL: ${{ secrets.CLOUDFLARE_ACCOUNT_EMAIL }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           CLOUDFLARE_LIST_ITEM_LIMIT: ${{ secrets.CLOUDFLARE_LIST_ITEM_LIMIT }}
           FAST_MODE: ${{ vars.FAST_MODE }}
@@ -55,8 +54,7 @@ jobs:
       - name: Create new rules and lists
         run: npm run cloudflare-create
         env:
-          CLOUDFLARE_API_KEY: ${{ secrets.CLOUDFLARE_API_KEY }}
-          CLOUDFLARE_ACCOUNT_EMAIL: ${{ secrets.CLOUDFLARE_ACCOUNT_EMAIL }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           CLOUDFLARE_LIST_ITEM_LIMIT: ${{ secrets.CLOUDFLARE_LIST_ITEM_LIMIT }}
           FAST_MODE: ${{ vars.FAST_MODE }}

extended_guide.md

@@ -16,13 +16,17 @@ https://dash.cloudflare.com/1234567890abcdef1234567890abcdef
 
 In this example, `1234567890abcdef1234567890abcdef` is the account ID.
 
-### `CLOUDFLARE_API_KEY`
+### `CLOUDFLARE_API_TOKEN`
 
-The Cloudflare API key can be found in the [Cloudflare dashboard](https://dash.cloudflare.com/) too. Click on your profile picture (or user icon) in the top right corner, then click on "API Tokens" in the sidebar. Scroll down to the "API Keys" section and click on "View" next to the Global API Key.
+Cloudflare API Token can be created in your [Cloudflare profile](https://dash.cloudflare.com/profile/api-tokens):
 
-### `CLOUDFLARE_ACCOUNT_EMAIL`
+1. Click "Create Token" and click "Get Started" in the "Create Custom Token" row.
+2. Enter any name for your token
+3. Add Zero Trust Read and Edit permissions for your account
+4. Click "Continue to summary" and click "Create Token"
+5. You will see the created API Token
 
-The Cloudflare account email is the email address you use to log in to the Cloudflare dashboard.
+![Creating API Token](.github/images/create_api_token.png)
 
 ### `CLOUDFLARE_LIST_ITEM_LIMIT`
 

lib/constants.js

@@ -2,7 +2,15 @@ import dotenv from "dotenv";
 
 dotenv.config();
 
-export const API_TOKEN = process.env.CLOUDFLARE_API_KEY;
+if (process.env.CLOUDFLARE_API_KEY) {
+  console.warn(
+    "Using Global API Key is very risky for your Cloudflare account. It is strongly recommended to create an API Token with scoped permissions instead."
+  );
+}
+
+export const API_KEY = process.env.CLOUDFLARE_API_KEY;
+
+export const API_TOKEN = process.env.CLOUDFLARE_API_TOKEN;
 
 export const ACCOUNT_ID = process.env.CLOUDFLARE_ACCOUNT_ID;
 
@@ -33,12 +41,11 @@ export const LIST_TYPE = {
 };
 
 export const USER_DEFINED_ALLOWLIST_URLS = process.env.ALLOWLIST_URLS
-  // .filter(x => x) removes empty items from the URL arrays
-  ? process.env.ALLOWLIST_URLS.split("\n").filter(x => x)
+  ? process.env.ALLOWLIST_URLS.split("\n").filter((x) => x)
   : undefined;
 
 export const USER_DEFINED_BLOCKLIST_URLS = process.env.BLOCKLIST_URLS
-  ? process.env.BLOCKLIST_URLS.split("\n").filter(x => x)
+  ? process.env.BLOCKLIST_URLS.split("\n").filter((x) => x)
   : undefined;
 
 export const RECOMMENDED_ALLOWLIST_URLS = [

lib/helpers.js

@@ -1,4 +1,10 @@
-import { ACCOUNT_EMAIL, ACCOUNT_ID, API_HOST, API_TOKEN } from "./constants.js";
+import {
+  ACCOUNT_EMAIL,
+  ACCOUNT_ID,
+  API_HOST,
+  API_KEY,
+  API_TOKEN,
+} from "./constants.js";
 
 if (!globalThis.fetch) {
   console.warn(
@@ -20,20 +26,30 @@ if (!globalThis.fetch) {
  * @returns {Promise}
  */
 const request = async (url, options) => {
-  if (!API_TOKEN || !ACCOUNT_ID || !ACCOUNT_EMAIL) {
+  if (!(API_TOKEN || API_KEY) || !ACCOUNT_ID) {
     throw new Error(
-      "One or more required secrets have not been added: CLOUDFLARE_API_KEY, CLOUDFLARE_ACCOUNT_ID, and CLOUDFLARE_ACCOUNT_EMAIL"
+      "The following secrets are required: CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID"
     );
   }
 
-  const response = await fetch(url, {
-    headers: {
+  const headers = API_TOKEN
+    ? {
         Authorization: `Bearer ${API_TOKEN}`,
         "Content-Type": "application/json",
+      }
+    : {
+        Authorization: `Bearer ${API_KEY}`,
+        "Content-Type": "application/json",
         "X-Auth-Email": ACCOUNT_EMAIL,
-      "X-Auth-Key": API_TOKEN,
-    },
+        "X-Auth-Key": API_KEY,
+      };
+
+  const response = await fetch(url, {
     ...options,
+    headers: {
+      ...options.headers,
+      ...headers,
+    },
   });
 
   if (!response.ok) {
@@ -42,8 +58,6 @@ const request = async (url, options) => {
 
   const data = await response.json();
 
-  console.log(`HTTP request succeeded: ${data.success}`);
-
   return data;
 };