Even CF cannot restrict the scope of a token to a single host.

Or a single DNS record.