Skip to content

Cloudflare integration

Connecting Cloudflare lets DXDT read your zones, DNS records, zone settings, firewall and page rules, SSL certificate packs, load balancers and Workers for incident and security diagnosis. The integration is strictly read-only.
Setup time ~6 minutes
Difficulty Easy

Access required: An account member who can create a scoped API token

Prerequisites

  • A Cloudflare account with the zones you want DXDT to see
  • Your Account ID (required for the Workers listing)

Setup

1. Open the API token creation page

In the Cloudflare dashboard, open the profile menu (top-right) and go to My Profile > API Tokens, then click Create Token (or go directly to https://dash.cloudflare.com/profile/api-tokens).

Note

Use a scoped API Token, not the legacy Global API Key — scoped tokens can be limited to read-only permissions.

2. Grant read-only permissions

Start from Create Custom Token and add Read permissions only, for example Zone > Zone > Read, Zone > DNS > Read, Zone > Zone Settings > Read, Zone > Firewall Services > Read, Zone > Page Rules > Read, Zone > SSL and Certificates > Read, Zone > Load Balancers > Read, and Account > Workers Scripts > Read.

  • Set Zone Resources to include the specific zones (or all zones) DXDT should read.
  • Set Account Resources to the account whose Workers you want listed.
  • Leave every permission at Read; add no Edit permissions.

Note

Read scopes only — DXDT never edits DNS, firewall, settings or any Cloudflare resource.

3. Create the token and copy your Account ID

Click Continue to summary then Create Token, and copy the token (shown once) — this is your api_token. Copy your Account ID from the account home page (right sidebar) or the dashboard URL; it is a 32-character hex string.

  • The token is sent as a Bearer token to the Cloudflare API v4.
  • Account ID is only required for list workers; zone commands accept a zone id or name.

Configuration fields

Field Where to find it
Account ID (account_id) Your 32-character hex Cloudflare Account ID (from the account home sidebar or dashboard URL). Required only for listing Workers; optional otherwise.
API Token (api_token) A read-only scoped Cloudflare API Token (not the Global API Key). Sent as a Bearer token. Required.

Verify the connection

Enter the API token (and Account ID for Workers) in the Cloudflare plugin's Configuration tab and click Install & Configure; the Live Status panel should show a healthy connection and the token's active status.

Security

Your Cloudflare API token and account id are stored encrypted per-tenant and are used only for read-only Cloudflare API operations.

Troubleshooting

401 / Invalid API Token

The token is mistyped, expired, or you supplied a Global API Key instead of a scoped token. Create a scoped API Token with Read permissions and re-save the configuration.

403 / Authentication error on certain resources

The token lacks the specific Read permission or the zone/account is outside its resource scope. Edit the token to add the missing Read permission and include the correct zones/account.

list workers fails with a missing-account error

No account_id was provided. Add your 32-character hex Account ID to the configuration.

Vendor documentation: https://developers.cloudflare.com/fundamentals/api/get-started/create-token/