# Purge-only API tokens

> API tokens limited to one zone that can only purge its cache and list its purges, for CI jobs.

An API token can now be created as purge-only: it is limited to one zone and can only purge that zone's cache and list its purges. Any other route, MCP included, answers `403 token_scope`. It is the token to give a CI job that purges after each deploy.

See the [Cache documentation](https://developers.openwaf.dev/cache/).