Cloudflare purge cache 403 "Authentication error" (code 10000) in CI

By Daniel Zoghalchali·Latchkey

Cloudflare accepted the request but rejected the credentials: a 403 with error code 10000 "Authentication error" means the API token or key in your purge step was absent, expired, or malformed. The zone and endpoint are fine; the auth is the problem.

What this error means

A curl to the purge_cache endpoint returns HTTP 403 with a JSON body of "success": false and an error "code": 10000, "message": "Authentication error". Public requests without a token fail the same way.

{
  "result": null,
  "success": false,
  "errors": [{ "code": 10000, "message": "Authentication error" }],
  "messages": []
}

Common causes

The API token secret is missing or empty in CI

The Authorization: Bearer header is built from a secret that was never set, was renamed, or is not exposed to the job, so Cloudflare sees no valid token and returns code 10000.

The token expired or was revoked

A scoped API token has a TTL or was rotated. The pipeline still sends the old value, which no longer authenticates.

How to fix it

Send a valid scoped token from a secret

1. Create an API token with the "Zone.Cache Purge" permission for the target zone.
2. Store it as a repository or organization secret.
3. Reference it in the Authorization header from the step env, never hard-coded.

- name: Purge Cloudflare cache
  run: |
    curl -sS -X POST \
      "https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/purge_cache" \
      -H "Authorization: Bearer ${CF_API_TOKEN}" \
      -H "Content-Type: application/json" \
      --data '{"purge_everything":true}'
  env:
    ZONE_ID: ${{ secrets.CF_ZONE_ID }}
    CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}

Verify the token before purging

Call the token verify endpoint first so an expired token fails with a clear message instead of a bare 403 on purge.

curl -sS "https://api.cloudflare.com/client/v4/user/tokens/verify" \
  -H "Authorization: Bearer ${CF_API_TOKEN}"

How to prevent it

• Keep the purge token in CI secrets and rotate it in one place.
• Scope the token to Cache Purge on the specific zone, nothing broader.
• Add a token verify call so expiry surfaces before the purge step.

Frequently asked questions

Related guides

References

• GitHub Actions documentation