Add API Token migration path and Service Key deprecation callout to …

[baubuchon-cf]

What

Adds API Token (recommended) and deprecation callout for Origin CA Service Keys
to the Keyless SSL key server setup partial, which renders on both the Public DNS
and Cloudflare Tunnel configuration pages.

Why

gokeyless v1.18.0 (July 7, 2026) shipped API Token support for server certificate
enrollment (PR #563). Origin CA Service Keys are being removed September 30, 2026
(AUTHN-180). The docs currently only document the deprecated Service Key path with
no mention of the deadline or the migration.

What changed

• Step 3 of Configure now shows both auth options (API Token recommended, Service Key deprecated)
• :::caution block with migration steps and September 30 deadline
• Links to v1.18.0 release notes, API Token creation, and deprecation notice

Verification

• api_token config field and KEYLESS_API_TOKEN env var confirmed from gokeyless source
• Zone > SSL and Certificates > Edit scope confirmed from PR add mongodb ssh tutorial #563
• Sep 30 2026 deadline confirmed from /fundamentals/api/get-started/ca-keys/
• Renders on both /ssl/keyless-ssl/configuration/public-dns/ and
  /ssl/keyless-ssl/configuration/cloudflare-tunnel/ via shared partial

Related: SHIP-15399, AUTHN-180, SECENG-13851

[cloudflare-docs-bot]

Review

⚠️ 1 warning, 💡 2 suggestions found in commit 40ce1b9.

Fix in your agent

Fix the following review findings in PR #32206 (https://github.com/cloudflare/cloudflare-docs/pull/32206).

Before making changes, review each finding and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g. the fix requires disproportionate effort for minimal benefit,
  or the finding is factually incorrect), explain why
- If you need clarification before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order

After triaging, fix all legitimate findings. For any you decide to skip,
post a comment on this PR with the finding ID and your reasoning.

---

## Style Guide Review

### Warnings (1)

#### SG-dfbbd9f9519d · Bold product/credential name
- **File:** `src/content/partials/ssl/keyless-key-server-setup.mdx` line 145
- **Issue:** Line bolds `API Token` as the credential name
- **Fix:** Use `API Token` in regular text or `api_token` in monospace when referring to the config field.

### Suggestions (2)

#### SG-37b3bed21b8e · Time-sensitive content
- **File:** `src/content/partials/ssl/keyless-key-server-setup.mdx` line 156
- **Issue:** Line contains the date `September 30, 2026` outside changelog content
- **Fix:** Remove or rewrite without the month and year unless the exact deadline is required.

#### SG-2ab0e7b6504e · Time-sensitive content
- **File:** `src/content/partials/ssl/keyless-key-server-setup.mdx` line 155
- **Issue:** Admonition title contains the date `September 30, 2026`
- **Fix:** Remove or rewrite without the month and year unless the exact deadline is required.

Code Review

This code review is in beta and may not always be helpful — use your judgment.

_{No code review issues found.}

Conventions

_{No convention issues found.}

Style Guide Review

Warnings (1)

File	Issue
partials/ssl/keyless-key-server-setup.mdx line 145	Bold product/credential name — Line bolds API Token as the credential name Fix: Use API Token in regular text or api_token in monospace when referring to the config field.

Suggestions (2)

File	Issue
partials/ssl/keyless-key-server-setup.mdx line 156	Time-sensitive content — Line contains the date September 30, 2026 outside changelog content Fix: Remove or rewrite without the month and year unless the exact deadline is required.
partials/ssl/keyless-key-server-setup.mdx line 155	Time-sensitive content — Admonition title contains the date September 30, 2026 Fix: Remove or rewrite without the month and year unless the exact deadline is required.

Commands

Only codeowners can run commands. Post a comment with the command to trigger it.

Command	Description
/review	Runs a review now. Incremental if a prior review exists, full if not.
/full-review	Re-reviews the entire PR diff from scratch, ignoring incremental history. Useful after a rebase, when you want a fresh review, or if the bot gets out of sync and reports issues that no longer exist.
/ignore-review-limit	Permanently lifts the 2-review automatic limit for this PR. Future pushes will trigger reviews as normal.
/disable-auto-review	Stops automatic reviews from triggering on future pushes to this PR. Codeowners can still run /review or /full-review manually.
/rebase	Rebases the PR branch against production. On conflict, attempts to resolve automatically using AI. Stops with an explanation if confidence is not high enough.

[github-actions]

This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:

Pattern	Owners
*	@cloudflare/product-owners

[github-actions]

Nimbus Preview URL: https://nimbus-40ce1b90.preview.developers.cloudflare.com
Nimbus Preview Branch URL: https://nimbus-keyless-api-token-deprecation-callout.preview.developers.cloudflare.com

[github-actions]

Preview URL: https://40ce1b90.preview.developers.cloudflare.com
Preview Branch URL: https://keyless-api-token-deprecation-callout.preview.developers.cloudflare.com