Hi! One of the engineers from the Flagship team here, app-scoped tokens are WIP.
This does not apply to Cloudflare, especially not for an auth token that needs to be published on your website that cannot be restricted.
I think you're thinking this:
> If you are not embarrassed by the first version of your product, you've launched too late. -Reid Hoffman