How to Delete a Cloudflare Access Application (Without Guesswork)

If you need to remove a Cloudflare Access app, the safest flow is:

1. List apps
2. Find the correct app_id
3. Delete it from the same scope (account or zone)

This guide gives exact commands for both account-level and zone-level Access apps.

Prerequisites

Set these environment variables first:

export CLOUDFLARE_API_TOKEN="***"
export ACCOUNT_ID="your_account_id"
# optional for zone-scoped apps
export ZONE_ID="your_zone_id"

Your API token needs Access app permissions for read/delete.

1) List Access Apps

Start by listing existing apps to get the id.

Account-level apps

curl -s -X GET "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/access/apps" \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

Zone-level apps

curl -s -X GET "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/access/apps" \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

2) Find the Right App Quickly

If you have many apps, filter with jq:

curl -s -X GET "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/access/apps" \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  | jq '.result[] | {id, name, domain}'

Pick the exact id you want to remove.

3) Delete the App

Use the same scope you used for listing.

Delete account-level app

curl -X DELETE "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/access/apps/$APP_ID" \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

Delete zone-level app

curl -X DELETE "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/access/apps/$APP_ID" \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

Common Mistakes

• Using account endpoint for a zone-scoped app (or the reverse)
• Deleting by name instead of id
• Using a token without Access app delete permission

Quick Verification

After deletion, list apps again and confirm the id is gone:

curl -s -X GET "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/access/apps" \
  -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  | jq '.result[] | {id, name, domain}'

Done. The app is removed once it no longer appears in the list response.