upvote
Even CF cannot restrict the scope of a token to a single host.
reply
Or a single DNS record.
reply