Add support for new Cloudflare API tokens, and defining credentials in wp-config.php

Nobody has claimed this yet.

Hi guys

Cloudflare recently released a new API tokens feature. This allows the creation of API credentials with restricted permissions and is the new recommended way of granting access to apps like Wordpress. Additionally, tokens can be restricted to a specific domain which is a huge for security. They have a Wordpress template too. From https://api.cloudflare.com/#getting-started-requests:

> API Tokens
> API Tokens provide a new way to authenticate with the Cloudflare API. They allow for scoped and permissioned access to resources and use the RFC compliant Authorization Bearer Token Header.
>

Here's a screenshot of their Wordpress template:


These new API requests use a single "Authorization: Bearer xxxxxxxxx" header instead of the "X-Auth-Email" and "X-Auth-Key" headers. So using the token in the existing "Global API" field doesn't work.

Would it be possible to add support for tokens? All other API request headers are identical so it would be easy to add the option to use a token instead of the global key if desired. Please note that the account email is no longer required with tokens. So the email field shouldn't be a required field if "API Token" is selected instead of "Global API Key".

Also, would you be able to add the ability to define credentials in wp-config.php for both options eg:

define('LITESPEED_CLOUDFLARE_API_TOKEN', 'put-your-API-token-here');
and
define( 'LITESPEED_CLOUDFLARE_API_KEY', 'put-your-global-API-key-here' );
define( 'LITESPEED_CLOUDFLARE_EMAIL', 'put-your-cloudflare-email-here' );

This is much better for security since the secrets aren't stored in the database. It also means other people with access to the plugin settings can't see the credentials.

Several plugins (eg. WP Rocket, WP SMTP Mail) offer this option. If these plugin detects the variables in wp-config, the form fields in the plugin settings page become greyed out and show something like "Set in wp-config.php".

Cheers!

Start with the existing Cloudflare Global API Key settings and request flow, then review the wp-config.php credential definitions described in the issue. Done means API Token authentication uses the bearer header without requiring email, Global API Key authentication still works, and credentials defined in wp-config.php are reflected in the settings UI without exposing editable secrets.

Written by the indexing model from the issue text.