One token, two accounts: minting Cloudflare API tokens from code
Cloudflare’s custom-token screen is fine the first time. We turned the click-heavy ritual into one script: a single user-owned token that spans two accounts, with the genuinely dangerous permissions cut on purpose. Here is the method, the scoping rule, the platform gotcha that enforces it, and the three checks that prove it works.