cloudflare / cloudflare/cloudflare-docs
API token template URL: incorrect permission keys in docs + UI rendering bug
- Dominant language
- MDX
- Stars
- 5.2k
- Forks
- 16.7k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 337
Description
### Existing documentation URL(s)
The permission reference table on the API token template URLs page contains incorrect permission key names.
When using the documented keys `workers_kv` and `zone_dns` in a template URL, these permissions are silently ignored — they don't appear in the token creation form. No error is shown.
The actual working keys are `workers_kv_storage` and `dns`.
### Steps to reproduce
**URL with documented keys (BROKEN — only 1 of 3 permissions appears):**
https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22workers_kv%22%2C%22type%22%3A%22edit%22%7D%2C%7B%22key%22%3A%22zone_dns%22%2C%22type%22%3A%22edit%22%7D%5D&accountId=%2A&zoneId=all&name=Test
**URL with correct keys (WORKS — all 3 permissions appear):**
https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22workers_kv_storage%22%2C%22type%22%3A%22edit%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22edit%22%7D%5D&accountId=%2A&zoneId=all&name=Test
Open both, click "← Edit token" to see permissions (there's also a UI rendering bug where dropdowns appear empty on first load).
### Additional note
There is also a UI rendering bug: when opening any template URL, the permission dropdowns appear empty on first load. Clicking "← Edit token" and returning to the form fixes it. The permissions are correctly applied internally — they show in the summary page — but the form UI doesn't render them initially.
### What changes are you suggesting?
1. Update the permission reference table with correct key names:
- `workers_kv` should be `workers_kv_storage`
- `zone_dns` should be `dns`
These were verified by testing template URLs — the documented keys are silently ignored while the corrected keys work as expected.
2. Consider auditing all keys in the reference table against the actual dashboard implementation, as there may be other mismatches.
3. The UI rendering bug (permissions not appearing in dropdowns on first load) may need to be filed separately with the dashboard team.
This matters because developers building platforms rely on template URLs to simplify API token creation for their end users. Incorrect key names cause permissions to be silently dropped with no error — users end up with tokens missing critical permissions without any indication of failure.
### Additional information
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.