fix: enforce cloudflare token/key format validation

- Reject API key-shaped values in Cloudflare api_token

- Validate Cloudflare api_key as 32-character hexadecimal format

- Add UI form validation to prevent token/key cross-input

- Update API and UI changelog entries for the current PR

ui/CHANGELOG.md

@@ -25,6 +25,7 @@ All notable changes to the **Prowler UI** are documented in this file.
 ### 🐞 Fixed
 
 - Findings Severity Over Time chart on Overview not responding to provider and account filters, and chart clipping at Y-axis maximum values [(#10103)](https://github.com/prowler-cloud/prowler/pull/10103)
+- Cloudflare credentials form now blocks API key values in `api_token` and token-like values in `api_key` [(#10195)](https://github.com/prowler-cloud/prowler/pull/10195)
 
 ### 🔐 Security
 

ui/types/formSchemas.ts

@@ -5,6 +5,8 @@ import { validateMutelistYaml, validateYaml } from "@/lib/yaml";
 
 import { PROVIDER_TYPES, ProviderType } from "./providers";
 
+const CLOUDFLARE_GLOBAL_API_KEY_REGEX = /^[a-fA-F0-9]{32}$/;
+
 export const addRoleFormSchema = z.object({
   name: z.string().min(1, "Name is required"),
   manage_users: z.boolean().default(false),
@@ -379,6 +381,15 @@ export const addCredentialsFormSchema = (
               message: "API Token is required",
               path: [ProviderCredentialFields.CLOUDFLARE_API_TOKEN],
             });
+          } else if (
+            CLOUDFLARE_GLOBAL_API_KEY_REGEX.test(apiToken.trim())
+          ) {
+            ctx.addIssue({
+              code: "custom",
+              message:
+                "This looks like an API Key. Use API Token credentials instead.",
+              path: [ProviderCredentialFields.CLOUDFLARE_API_TOKEN],
+            });
           }
         } else if (via === "api_key") {
           const apiKey = data[ProviderCredentialFields.CLOUDFLARE_API_KEY];
@@ -389,6 +400,15 @@ export const addCredentialsFormSchema = (
               message: "API Key is required",
               path: [ProviderCredentialFields.CLOUDFLARE_API_KEY],
             });
+          } else if (
+            !CLOUDFLARE_GLOBAL_API_KEY_REGEX.test(apiKey.trim())
+          ) {
+            ctx.addIssue({
+              code: "custom",
+              message:
+                "API Key must be a 32-character hexadecimal Cloudflare Global API Key.",
+              path: [ProviderCredentialFields.CLOUDFLARE_API_KEY],
+            });
           }
           if (!apiEmail || apiEmail.trim() === "") {
             ctx.addIssue({