Fundamentals

Get started
Before you can begin using Cloudflare products, first create an account. If multiple people manage your Cloudflare account, set up member permissions to control which resources each person can access.
Learn about Cloudflare's offerings
Build
Build is where developers create and deploy simple sites and full-stack applications on the Workers compute platform, and connect them to storage and database primitives like KV (key-value data store), D1 (SQL database), R2 (object storage), Queues (asynchronous messaging), Durable Objects (stateful coordination), and more.
Our compute, orchestration, AI, storage, media, and security services are integrated, so you can quickly extend existing apps or launch new ones while Cloudflare's global network takes care of infrastructure, scaling, and performance for you.
Protect & Connect
Protect & Connect is where you establish fast and reliable connections between your websites, apps, and users, while protecting them from attackers and unwanted traffic.
Application security and performance focuses on resources available on the public Internet. Manage delivery performance by controlling and speeding up primarily Layer 7 (Application) traffic, in addition to managing media such as video and images. Get started by onboarding a domain.
Zero Trust protects private, internal users/devices and the resources they access. Get started with Zero Trust.
Network services extend protection and acceleration to cloud, on-premise, or hybrid networks, and you can also manage network connections and optimize Layer 3 (Network) and 4 (Transport) traffic. Get started with Magic Transit or Cloudflare WAN (formerly Magic WAN).

Cloudflare Fundamentals
Before you get started, we recommend reviewing Concepts to learn about key concepts related to using different Cloudflare products.
Additional resources
Refer to the list below for additional Cloudflare resources.
Cloudflare blog
Cloudflare's Go library
Cloudflare system status
Cloudflare Radar
Cloudflare TV
Terraform

Change Super Administrator
If you or someone in your organization leaves or loses access to email, you can add another Super Administrator using any other Super Administrator on your Account with a verified email address.
First, add a member to your account and assign the Super Administrator role.
Then, if needed, remove the previous Super Administrator.
:::note
Cloudflare recommends having more than one user as Super Administrators for your accounts, so that if you are unable to login with your credentials for any reason, there is another one you can use to manage your domains.
:::

Create account
To create your first Cloudflare account:
Go to the Sign up page.
Enter your Email and Password.
Select Create Account.
Once you create your account, Cloudflare will automatically send an email to your address to verify that email address.
Create an additional Free account
Existing users can create additional Free accounts in the dashboard or with the API.
Eligibility
The following requirements apply to Free account creation:
Your Cloudflare user must be active and at least seven days old.
You must have the Super Administrator role on an existing account.
You can create up to five additional Free accounts.
Create an account in the dashboard
Log in to the Cloudflare dashboard and go to Accounts.
https://dash.cloudflare.com/
Select Create Account.
Enter an account name.
Select Create Account.
Create an account with the API
Use a user-owned API token or OAuth access token. Account-owned API tokens cannot create accounts.
A user-owned API token requires the User Details Read permission. An OAuth access token requires the 
user-details.read scope.
Set the 
standalone field to 
true and omit 
unit. Every Free account creation request requires exactly one valid 
Idempotency-Key header. Reuse the same key when retrying the same request.
API token
	Set `CLOUDFLARE_API_TOKEN` to a user-owned API token. Set `IDEMPOTENCY_KEY` to a unique value for this account creation request.
	```bash
	curl "https://api.cloudflare.com/client/v4/accounts" \
		--request POST \
		--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
		--header "Content-Type: application/json" \
		--header "Idempotency-Key: $IDEMPOTENCY_KEY" \
		--data '{"name":"Example account","type":"standard","standalone":true}'
	```
OAuth
	Set `CLOUDFLARE_OAUTH_TOKEN` to an OAuth access token. Set `IDEMPOTENCY_KEY` to a unique value for this account creation request.
	```bash
	curl "https://api.cloudflare.com/client/v4/accounts" \
		--request POST \
		--header "Authorization: Bearer $CLOUDFLARE_OAUTH_TOKEN" \
		--header "Content-Type: application/json" \
		--header "Idempotency-Key: $IDEMPOTENCY_KEY" \
		--data '{"name":"Example account","type":"standard","standalone":true}'
	```
For the complete request schema, refer to Create Account.
Resolve account creation errors
Use the error message to resolve common account creation failures:
Error
Resolution
Your user is less than seven days old.
Wait until the user is at least seven days old.
You are not a Super Administrator.
Confirm that you have the Super Administrator role on an existing account.
You reached an account creation limit.
Use an existing account or contact your account team.
Account creation is temporarily unavailable.
Retry the request later with the same idempotency key.
The idempotency key was used for a different request.
Use a new key for the new request. Reuse the original key only for an identical retry.
Your user is suspended.
Contact Cloudflare Support.
Account name
Your account name defaults to 
<<YOUR_EMAIL_ADDRESS>>'s Account.
You may want to customize the name of this account, either to help specify its purpose or to help associate it with multiple accounts.
To change your account name:
In the Cloudflare dashboard, go to the Configurations page.
https://dash.cloudflare.com/?to=/:account/configurations
For Account Name, select Change Name.
Enter a new account name.
Select Save.
Best practices
Refer to Account and domain management best practices for a detailed list of ways to protect your account and domain.
Once you set up an account, you have several ways to interact with Cloudflare.
Interact with Cloudflare
If you prefer working without code, you can manage your account and domain settings through the Cloudflare dashboard.
:::note
If your domain was added to Cloudflare by a hosting partner, manage your DNS records via the hosting partner.
:::
For those who prefer to interact with Cloudflare programmatically, you can use several methods:
Resource
Docs
Description
Cloudflare API
API docs
RESTful API based on HTTPS requests and JSON responses.
Terraform
Terraform docs
Configure Cloudflare using HashiCorp's Infrastructure as Code tool, Terraform.
cloudflare-go
README
The official Go library for the Cloudflare API.
cloudflare-typescript
README
The official TypeScript library for the Cloudflare API.
cloudflare-python
README
The official Python library for the Cloudflare API.

Find account and zone IDs
Once you set up a new account and add your domain to Cloudflare, you may need access to your zone and account IDs for API operations.
Copy your account ID
Open the Cloudflare dashboard.
https://dash.cloudflare.com/?to=/:account/home
Select Search (or press 
CMD/CTRL + K from any page).
Enter 
Copy account ID and select the result to copy.
Copy your zone ID
In the Cloudflare dashboard, select the domain you want the zone ID for.
https://dash.cloudflare.com/?to=/:account/domains/overview
On the domain Overview page, locate the API section towards the bottom of the page.
Select the copy button next to Zone ID. You can also copy Account ID from this section.
Find account ID in Workers & Pages
You can also find your account ID from the Workers & Pages section of your account.
In the Cloudflare dashboard, go to Workers & Pages.
https://dash.cloudflare.com/?to=/:account/workers-and-pages
Locate the Account Details section.
Select the copy button next to Account ID.

Accounts
If you need help setting up a new Cloudflare account, refer to the following resources:

Add abuse contact
Enter an abuse contact email address to ensure you are receiving communications regarding potential abuse on your websites.
To update your abuse contact email address:
Log into the Cloudflare dashboard and select your account.
Go to Manage Account > Configurations.
For Abuse report contact email address, select Change email address.
Enter and confirm your new email and select Save.
If you choose not to provide an abuse contact email address, communication about abuse will be directed to one of the Super Administrators on your account.

Audit Logs - version 2
Cloudflare Audit Logs are account-based. All user-initiated actions are recorded automatically across both the Cloudflare API and dashboard. System-initiated logs are also captured to reflect actions taken automatically by Cloudflare systems, such as configuration updates, background processes, or internal policy enforcement.
When a user-initiated action triggers additional automated behavior, corresponding system-initiated logs will be generated. In some cases, user-initiated logs include additional enrichments that provide more context about what was changed, offering deeper visibility into the full lifecycle of the action.
When an action occurs, it is streamed through Cloudflare's audit logging pipeline and stored. This ensures consistent visibility into activity across all products.
For more detailed information about how the user-initiated actions are logged automatically, refer to the Cloudflare Blog.
:::note
A transition plan from Audit Logs v1 to Audit Logs v2 will be communicated in due course.
:::
Key features
Audit Logs (version 2) provide a unified and standardized system for tracking and recording actions across Cloudflare products. This system enhances transparency and accountability by offering comprehensive insights into user-initiated and system-initiated activities within your Cloudflare environment.
Standardized logging: Audit logs are automatically generated in a consistent format across all Cloudflare services, ensuring uniformity and eliminating inconsistencies.
Expanded product coverage: Audit Logs covers ~95% of Cloudflare products, capturing actions from key endpoints, such as 
/accounts, 
/zones, 
/organizations, 
/user, and 
/memberships APIs.
Granular filtering: Uniformly formatted logs allow for precise filtering by actions, actors, methods, and resources, facilitating efficient investigations.
Enhanced context and transparency: Each log entry includes detailed context, such as the authentication method used, the interface (API or dashboard) through which the action was performed, and mappings to Cloudflare Ray IDs for improved traceability.
Comprehensive activity capture: Audit Logs records create, update, delete, and view actions for the same endpoints covered above, with a small number of excluded endpoints.
Retention
Audit logs are retained for 18 months before being deleted. No additional setup is required.
In the Audit Logs v2 UI, queries are limited to the most recent 90 days for performance reasons. To access the full 18 months of data, use the API or Logpush.
Enterprise customers can use Logpush to store audit logs beyond 18 months.
:::note
Approximately 30 days of logs from the Beta period (back to ~February 8, 2026) are available at GA. These Beta logs will expire on ~April 9, 2026. Logs generated after GA will be retained for the full 18 months. Older logs remain available in Audit Logs v1.
:::
Access Audit Logs
You can retrieve audit logs using the Cloudflare dashboard, the API, or Logpush.
API
Audit Logs are available through the Cloudflare API. To retrieve audit logs, use the following endpoint:
https://api.cloudflare.com/client/v4/accounts/{account_id}/logs/audit
Below is an example request to retrieve audit logs for a certain period of time along with its corresponding response. Replace the example values in the URL with your actual values:
account_id: Your Cloudflare account identifier.
since (required): Start date for the audit log retrieval. Accepts 
yyyy-mm-dd (interpreted as UTC) or RFC3339 timestamp (
yyyy-mm-ddTHH:MM:SSZ).
before (required): End date for the audit log retrieval. Same format as 
since.
GET https://api.cloudflare.com/client/v4/accounts/1234567890abcdef/logs/audit?since=2025-03-01T00:00:00Z&before=2025-03-26T23:59:59Z
{
	"result": [
		{
			"action": "zone.settings.change",
			"actor": {
				"email": "user@example.com",
				"id": "0987654321abcdef"
			},
			"ip": "192.0.2.1",
			"method": "PUT",
			"interface": "dashboard",
			"resources": [
				{
					"resource_id": "zone123",
					"resource_type": "zone"
				}
			],
			"timestamp": "2025-03-15T14:25:37Z"
		}
		// Additional log entries
	],
	"success": true,
	"errors": [],
	"messages": []
}
For more information refer to the API documentation.
Dashboard
To access audit logs in the Cloudflare dashboard, go to Manage Account > Audit Logs.
https://dash.cloudflare.com/?to=/:account/audit-log
:::note
The Audit Logs v2 is shown by default. You can switch between Audit Logs v2 and v1 as needed.
:::
View actions
By default, the Audit Logs v2 dashboard excludes 
view actions to reduce noise. This default filter (Action type is not 
view) applies to both account-level and organization-level audit logs. To include 
view actions, remove this filter. To show only 
view actions, set Action type to 
view.
view actions remain available through the API and Logpush regardless of the dashboard filter.
Account analytics
The account-level Audit Logs v2 dashboard includes analytics for the selected time range. The Actions over time chart separates successful and failed actions. The summary cards show Total actions, Unique actors, Products impacted, and Failure rate.
Select a summary card to view more details:
Total actions: Action types and authentication methods
Unique actors: Actors with the most actions
Products impacted: Products with the most actions
Failure rate: Failed actions and their HTTP status codes
To focus the analytics and audit log table on a value, select Filter or Exclude from a detail panel. The analytics, table, filters, and time range remain synchronized.
:::note
Account analytics are available for account-level audit logs. They are not available for organization-level audit logs.
:::
Logpush
:::note
For customers who already have a Logpush job set up for Audit Logs v1, note that a separate Logpush job must be configured for Audit Logs v2 (dataset). We will communicate the timeline for when Logpush Audit Logs v1 will be deprecated and turned off.
:::
To create a Logpush job:
In the Cloudflare dashboard, go to the Logpush page.
https://dash.cloudflare.com/?to=/:account/logs
Select Create a Logpush job.
In Select a destination, select the destination of your choice and add the destination details.
In the datasets section, select the Audit Logs v2 dataset. Audit Logs v2 is an account-based dataset.
Once you are done configuring your logpush job, select Submit.
Resource History
Resource History shows what changed on every configuration modification captured in Audit Logs. For any audit log entry, you can see the sequence of previous changes to the same resource and view a side-by-side diff of what was modified.
Resource History is available in the Cloudflare dashboard and via the Audit Logs API. It uses the audit log entries you already have. There is no additional configuration, no backend recapture, and no changes to how audit logs are generated.
What Resource History gives you
For any audit log entry, Resource History retrieves every other audit log entry for the same resource, ordered chronologically. You can then pick an earlier entry from that history to see exactly which fields changed between the two.
Use Resource History in the dashboard
Go to Manage Account > Audit Logs.
Open any audit log entry.
Select the History tab to see the full history for the resource that entry describes.
In the history view, select any earlier entry to see a side-by-side diff of the fields that changed between it and the current entry.
When Resource History cannot identify the underlying resource (for example, for certain system-initiated events), the dashboard shows an empty state indicating that change history is not available for that entry.
Use Resource History via the API
You can retrieve the change history for any audit log entry using the History endpoint. Given the 
id of a source audit log entry, the endpoint derives identifying filters from that entry and returns matching audit log entries within a date window you specify.
For account-scoped audit logs, use:
GET https://api.cloudflare.com/client/v4/accounts/{account_id}/logs/audit/{id}/history
For organization-scoped audit logs, use:
GET https://api.cloudflare.com/client/v4/organizations/{organization_id}/logs/audit/{id}/history
The 
{id} path parameter is the 
id of the source audit log entry whose resource history you want to retrieve.
:::note[Required API token permissions]
At least one of the following token permissions is required:
Account Settings Read
Account Settings Write
:::
The endpoint requires three query parameters:
action_time (required): RFC3339 timestamp of the source audit log entry's action time. Provide the 
action.time value from the audit log identified by 
{id}. This narrows the source-entry lookup window.
since (required): Limits returned results to entries newer than this date. Accepts a date string (
2024-10-30, interpreted as UTC) or an RFC3339 timestamp.
before (required): Limits returned results to entries older than this date. Same format as 
since.
Optional query parameters:
direction: 
desc (default) or 
asc.
limit: Number of entries to return per page. Default 
100.
cursor: Pagination cursor from a previous response's 
result_info.cursor.
GET /accounts/{account_id}/logs/audit/{id}/history
Each entry in 
result has the same shape as an entry returned by the Audit Logs list endpoint. Results are paginated using the 
cursor value in 
result_info.
The 
result_info.history_status field indicates the quality of resource identification used to build the history:
exact: The source entry contained a resource URI, so the history was built from an exact resource match.
approximate: The source entry did not contain a resource URI, so the history was built from an approximate match (other resources of the same product and type). The dashboard surfaces this state with a warning banner.
unavailable: The source entry did not contain enough information to identify the resource. 
result is empty. This can happen for certain system-initiated events.
Resource History reflects the audit log entries currently retained by Audit Logs v2 (refer to Retention). Entries older than the retention window are not returned. Resource History is a query-time capability and is not exposed as additional fields in the 
audit_logs_v2 Logpush dataset.
Audit Log structure
Cloudflare's audit logs offer a detailed view of activity across your environment by capturing both the source of actions and the context in which they occur. These logs are categorized by who initiated the action (user or system) and whether the activity occurred within a specific account or spanned multiple accounts under the same user profile. This structure enables flexible filtering, investigation, and compliance monitoring.
Initiation type
Audit logs can be initiated either by users or the system. Understanding the type of actor involved helps in identifying the source and intent of actions.
User initiated Audit Logs
Track actions initiated by users through Cloudflare interfaces, including the dashboard and API. These logs capture who or what performed the action. They also record when it occurred and which resource was affected. User-initiated actions can have four actor types:
actor_type="user": Action was performed by an individual user.
actor_type="cloudflare_admin": Action was performed by Cloudflare.
actor_type="account": Action was performed using an account API token. Refer to the Account API tokens documentation for more information.
actor_type="delegated_service": Action was performed by a Cloudflare service acting on a user's behalf. The log does not identify the initiating user.
System initiated Audit Logs
Record changes made automatically by Cloudflare systems, without direct user input. These logs provide visibility into internal processes, automated tasks, and security events. Some entries may include associated user context for traceability (
actor_type="system").
Activity Scope
Account Activity Logs
Contain events scoped to a single Cloudflare account. These logs are filterable by 
account ID and reflect actions within that account only. You can optionally filter events further using the 
resource_scope field, which specifies whether the resource is associated with a user, an account, or a zone (
resource_scope ="user", 
resource_scope ="accounts", or 
resource_scope ="zones").
User Profile Activity Logs
Reflect actions associated with a user's login (email) across multiple accounts. These logs enable cross-account tracking and can be filtered by 
user ID or 
email. They are visible on any account the user had access to at the time of the activity. User Profile Activity Logs can be filtered using 
resource_scope ="user".
The 
GET /memberships endpoint supports cross-account access. To query memberships, use the parameter 
resource_scope=memberships.
Organization Activity Logs
Contain events scoped to specific Cloudflare Organizations. These logs capture user-initiated actions performed by Org Admins through organization-level APIs.
You can retrieve Organization audit logs using either the API or the Cloudflare dashboard.
API access
Retrievable via the Audit Logs v2 API:
GET https://api.cloudflare.com/client/v4/organizations/{organization_id}/logs/audit
Dashboard access
To access organization audit logs in the Cloudflare dashboard, go to Organizations > (select your organization) > Manage Organization > Audit Logs.
If you are viewing account-level audit logs and the account belongs to an organization where you are an Organization Super Administrator, you can navigate to the parent organization's audit logs using the View Organization Audit Logs button.
:::note
Organization-level audit logs are separate from account-level audit logs. Actions performed within a specific account continue to be available via the account-level Audit Logs UI, Audit Logs v2 API, and Logpush.
This release covers user-initiated actions only. Support for system-initiated actions and Logpush for organizations will be added in future releases.
:::
Example how to query Audit Logs
Use the following example to get a list of audit logs for a Cloudflare account.
GET /accounts/{account_id}/logs/audit
{
	"errors": [
		{
			"message": "message"
		}
	],
	"result": [
		{
			"account": {
				"id": "4bb334f7c94c4a29a045f03944f072e5",
				"name": "Example Account"
			},
			"action": {
				"description": "Add Member",
				"result": "success",
				"time": "2024-04-26T17:31:07Z",
				"type": "create"
			},
			"actor": {
				"id": "f6b5de0326bb5182b8a4840ee01ec774",
				"context": "dash",
				"email": "alice@example.com",
				"ip_address": "198.41.129.166",
				"token_id": "token_id",
				"token_name": "token_name",
				"type": "user"
			},
			"raw": {
				"cf_ray_id": "8e9b1c60ef9e1c9a",
				"method": "POST",
				"status_code": 200,
				"uri": "/accounts/4bb334f7c94c4a29a045f03944f072e5/members",
				"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Safari/605.1.15"
			},
			"resource": {
				"id": "id",
				"product": "members",
				"request": {},
				"response": {},
				"scope": {},
				"type": "type"
			},
			"zone": {
				"id": "id",
				"name": "example.com"
			}
		}
	],
	"result_info": {
		"count": "1",
		"cursor": "ASqdKd7dKgxh-aZ8bm0mZos1BtW4BdEqifCzNkEeGRzi_5SN_-362Y8sF-C1TRn60_6rd3z2dIajf9EAPyQ_NmIeAMkacmaJPXipqvP7PLU4t72wyqBeJfjmjdE="
	},
	"success": true
}
Common terms and definitions
Actor
The actor represents who or what performed the action. Its identity attributes depend on the actor type. These attributes can include a user ID, email address, and IP address. Actor types include 
user, 
account, 
cloudflare_admin, 
delegated_service, or 
system. An actor can also include the context used to initiate the action:
api: The action was performed through the API. The specific credential type was not recorded.
api_key: The action was authenticated with a Cloudflare Global API Key.
api_token: The action was authenticated with an API token.
dash: The action was performed through the Cloudflare dashboard.
oauth: The action was authenticated with an OAuth token.
origin_ca_key: The action was authenticated with an Origin CA key.
Action
The action field captures the nature of the event and whether it was successful. It includes a high-level type (e.g., 
create, 
update, 
delete), a specific description (such as 
SSO_LOGIN), the timestamp of when the action occurred, and the result (
success or 
failure).
view actions are recorded for supported endpoints and are available through the Audit Logs v2 API and Logpush. The dashboard excludes 
view actions by default. For details, refer to View actions.
Account
This field refers to the Cloudflare account under which the action was executed. It includes a unique account ID and a human-readable account name to help associate activity with a customer environment.
Resource
The resource identifies the object impacted by the action. It includes the resource type, the unique resource ID, the scope (
user, 
account, or 
zone), and optionally the product associated with the change.
Audit Log ID
This is a unique identifier for the log record itself. It can be used for deduplication, correlation, or referencing specific actions during investigations.

Allow Cloudflare access
Occasionally, you may want to allow edit access to your Account Team. A typical use case might be migrating a complex or sensitive domain over to Cloudflare.
By default, Cloudflare does not have edit access to your account.
To enable editing access by your Account Team:
In the Cloudflare dashboard, go to the Configurations page. (You must be logged in as a Super Administrator).
https://dash.cloudflare.com/?to=/:account/configurations
For Editing Permission, switch the toggle to On.
Select a duration.
Click Approve.
:::note
In an emergency, Cloudflare Support can override your Editing Permissions and make updates to your account, but your Super Administrator will receive an email and the action will be recorded in your Audit Logs with an Action of Break glass.
:::

Account security


Leaked Password Notifications
Cloudflare automatically checks if your password has been compromised when you log in to the Cloudflare dashboard. Every time you log in to your account, we will securely verify through threat intelligence sources to confirm if your password has been leaked in a past data breach.
Refer to the blog post for more information on how Cloudflare checks for leaked credentials.
:::note[Note]
Cloudflare does not have additional information about the specific breach or Internet service that potentially lost your password.
Popular online tools such as Have I Been Pwned can help you better understand where your external accounts were attacked. If you reused this password in other systems, it is recommended that you reset it in those as well.
:::
If your password is found in a data breach, we will email you information on how to reset your password and prompt you to do so in the Cloudflare dashboard.
Your first three login attempts will warn you of the need to reset your password. After three attempts, you will be required to reset your password to log in to Cloudflare.
Users leveraging Single Sign-On (SSO) or two-factor authentication (2FA) will not be subject to these requirements given the higher level of security provided by those features.
We encourage you to enable two-factor authentication to secure your account.
Cloudflare account Super Administrators can also require that all members enable 2FA. This functionality can be enabled by going to Manage Account > Members in the Cloudflare dashboard.

Manage active sessions
View active sessions
To view the active sessions associated with your email address:
In the Cloudflare dashboard, go to the Account home page.
https://dash.cloudflare.com/?to=/:account/home
Go to My Profile > Sessions.
Revoke active sessions

Review audit logs - v1
:::note
Audit Logs version 2 is available. Refer to the Audit Logs v2 documentation for more details.
:::
Access audit logs
Using the dashboard
Using the API
Retention
Audit Logs are retained for 18 months before being deleted. Enterprise customers can use Logpush to store Audit Logs for longer periods of time.

Secure compromised account
If you observe suspicious activity within your Cloudflare account, secure your account with these steps.
Step 1 - Change your password
For more guidance on changing your password, refer to Change email address or password.
Step 2 - Revoke active account sessions
Step 3 - Enable Two-Factor Authentication (2FA)
To prevent future compromises, make sure that you have Two-Factor Authentication (2FA) enabled on your account.
Step 4 - Change API keys and tokens
API keys
API tokens
Step 5 - Review the audit log
If you notice any settings were changed, you should undo those changes.

Zone holds
Zone holds prevent other teams in your organization from adding zones that are already active in another account.
For example, you might already have an active Cloudflare zone for 
example.com. If another team does not realize this, they could add and activate 
example.com in another Cloudflare account, which may cause downtimes or security issues until the original zone could be re-activated.
:::note
Zone holds are enabled by default for all Enterprise zones.
:::
Availability
Free
Pro
Business
Enterprise
Availability
No
No
No
Yes
Enable zone holds
When you enable a zone hold, no one else can add your zone to their Cloudflare account. If they attempt to, they will receive the following message:
The zone name provided is subject to a hold which disallows the creation of this zone. Please contact the domain owner to have this hold removed.
To enable a zone hold:
Log into the Cloudflare dashboard.
Select your account and zone.
On the zone homepage, go to Quick Actions.
For Zone Hold, switch the toggle to On.
You also have the option to Also prevent subdomains, which prevents anyone in your organization from creating subdomains or custom hostnames related to your zone.
:::note
A zone hold also blocks operations such as adding a Pages custom domain or custom hostname for a hostname under the hold, even within the same Cloudflare account. To configure a custom domain on a held zone or subdomain, temporarily release the zone hold during setup.
:::
Release zone holds
You may want to temporarily release a zone hold to allow another team to register a subdomain in a separate Cloudflare account (such as 
docs.example.com), or to add a Pages custom domain under a held domain.
To release a zone hold:
Log into the Cloudflare dashboard.
Select your account and zone.
On the zone homepage, go to Quick Actions.
For Zone Hold, switch the toggle to Off.
Choose the length of your release.
Select Release hold.

Provision with Authentik
Once you have gathered the required data, the following steps will be required to finish the provisioning with Authentik.
Set up your Authentik SCIM provider
In the Authentik Admin interface, go to Applications > Providers.
Select Create and choose SCIM Provider.
Name your provider (for example, 
Cloudflare SCIM).
In URL, enter: 
https://api.cloudflare.com/client/v4/accounts/<accountID>/scim/v2, substituting 
<accountID> for your Cloudflare Account ID.
In Token, Paste the SCIM provisioning API token.
(Optional) Adjust the User filtering and Group filtering settings to control which users and groups are synchronized.
Select Finish to create the provider.
Create an Authentik application
In the Authentik Admin interface, go to Applications > Applications.
Select Create.
Name your application (for example, 
Cloudflare Dashboard).
In Provider, select the SCIM provider you created in the previous step.
Select Create to save the application.
Configure user and group sync in Authentik
:::note
The Update User Attributes option is not supported.
:::
In the Authentik Admin interface, go to Directory > Groups.
Create or select the groups you want to synchronize with Cloudflare. Ensure the users you want to provision are members of these groups.
Return to Applications > Providers and select your SCIM provider.
Under Backchannel Providers, verify that your SCIM provider is correctly linked to the application.
To trigger a manual sync, select Sync from the provider page. Authentik will also perform automatic periodic syncs based on your configured schedule.
Verify the integration
To verify the integration:
In Authentik, go to Applications > Providers, select your SCIM provider, and review the Sync status section for any errors.
In the Cloudflare dashboard, go to Manage Account > Members > User Groups to view the synchronized groups.
Check the Audit Logs in the Cloudflare dashboard by going to Manage Account > Audit Log.
Assign policies to user groups
After users and groups are synchronized, you can assign policies to user groups:
In the Cloudflare dashboard, go to Manage Account > Members > User Groups.
https://dash.cloudflare.com/?to=/:account/members
Select the group you want to configure.
Assign the appropriate policies to define the roles for group members.

Provision with Microsoft Entra
Once you have gathered the required data, the following steps will be required to finish the provisioning with Entra.
Set up the Enterprise application
Go to the Entra admin center and select Applications > Enterprise Applications.
In the Microsoft Entra Gallery, select New application > Create your own application, then choose a name.
Select Integrate any other application you don't find in the gallery (Non-gallery).
Create an application.
Provision the Enterprise application
Inside the newly created application under Manage from the sidebar menu, select Provisioning.
Select New configuration and enter the Tenant URL: 
https://api.cloudflare.com/client/v4/accounts/<ACCOUNT_ID>/scim/v2. Replace 
<ACCOUNT_ID> with your own account ID.
Retrieve the SCIM provisioning API token previously generated and paste its value as Secret token.
Select Test Connection then Save the configuration.
Configure user and group synchronization
Navigate to the newly created application under Manage from the sidebar menu, select Users and groups.
Assign users and groups to the application.
After the users are assigned, navigate to Provisioning on the sidebar menu and select Start Provisioning.
:::note
To successfully synchronize the group details into Cloudflare the 
User Principal Name (of 
Identity) and 
Email (of 
Contact Information) fields of each user must be identical. Values are case-sensitive, and the User Principal Name can only contain alphanumeric characters. Learn more about how to create, invite, and delete users.
:::
To validate which users and groups have been synchronized, navigate to Provisioning logs on the sidebar menu. You can also review the Cloudflare Audit Logs.
:::caution[Read-only group]
If the Entra group shares the same name of an existing Cloudflare user group, the Cloudflare user group will become read-only after the provisioning.
:::
To grant permissions to users and groups at Cloudflare, refer to Roles and Policies.
(Optional) Automate Cloudflare's SCIM integration
Cloudflare's SCIM integration requires one external application per account. Customers with multiple accounts may want to automate part of the setup to save time and reduce the amount of time spent in the Entra administrative UI.
The initial setup of creating the non-gallery applications and adding the provisioning URL and API key are scriptable via API, but the rest of the setup is dependent on your specific need and IDP configuration.
1. Get an access token
Get an Entra access token. Note that the example below is using the Azure CLI.
# Using azure-cli
az login
az account get-access-token --resource https://graph.microsoft.com
(payload with accessToken returned)
2. Create a new application via template.
The template ID 8adf8e6e-67b2-4cf2-a259-e3dc5476c621 is the suggested template to create non-gallery apps in the Entra docs. Replace 
<accessToken> and 
displayName with your values.
curl -X POST 'https://graph.microsoft.com/v1.0/applicationTemplates/8adf8e6e-67b2-4cf2-a259-e3dc5476c621/instantiate' \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <accessToken>' \
  --data-raw '{
    "displayName": "Entra API create application test"
}'
{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#microsoft.graph.applicationServicePrincipal",
  "application": {
    "id": "343a8552-f9d9-471c-b677-d37062117cc8", //
    "appId": "03d8207b-e837-4be9-b4e6-180492eb3b61",
    "applicationTemplateId": "8adf8e6e-67b2-4cf2-a259-e3dc5476c621",
    "createdDateTime": "2025-01-30T00:37:44Z",
    "deletedDateTime": null,
    "displayName": "Entra API create application test",
    "description": null,
    // ... snipped rest of large application payload
  },
  "servicePrincipal": {
    "id": "a8cb133d-f841-4eb9-8bc9-c8e9e8c0d417", // Note this ID for the subsequent request
    "deletedDateTime": null,
    "accountEnabled": true,
    "appId": "03d8207b-e837-4be9-b4e6-180492eb3b61",
    "applicationTemplateId": "8adf8e6e-67b2-4cf2-a259-e3dc5476c621",
    "appDisplayName": "Entra API create application test",
	// ...snipped rest of JSON payload
}
}
3. Create a provisioning job
To enable provisioning, you will also need to create a job. Note the SERVICE_PRINCIPAL_ID in the previous request will be used in the request below. The SCIM templateId is an Entra provided template.
curl -X POST 'https://graph.microsoft.com/v1.0/servicePrincipals/<SERVICE_PRINCIPAL_ID>/synchronization/jobs' \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <accessToken>' \
  --data-raw '{
    "templateId": "scim"
}'
{
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#servicePrincipals('a8cb133d-f841-4eb9-8bc9-c8e9e8c0d417')/synchronization/jobs/$entity",
  "id": "scim.5b223a2cc249463bbd9a791550f11c76.03d8207b-e837-4be9-b4e6-180492eb3b61",
  "templateId": "scim",
  "schedule": {
    "expiration": null,
    "interval": "PT40M",
    "state": "Disabled"
  },
}
// ... snipped rest of JSON payload
4. Configure the SCIM provisioning URL and API token
Next, configure the Tenant URL (Cloudflare SCIM endpoint) and API token (SCIM Provisioning API Token).
Replace 
<accessToken>, 
<ACCOUNT_ID>, 
<SCIM_PROVISIONING_API_TOKEN_VALUE> with your values.
 --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <accessToken>' \
  --data-raw '{
  "value": [
    {
      "key": "BaseAddress",
      "value": "https://api.cloudflare.com/client/v4/accounts/<ACCOUNT_ID>/scim/v2"
    },
    {
      "key": "SecretToken",
      "value": "<SCIM_PROVISIONING_API_TOKEN_VALUE>"
    }
  ]
}'
After completing the tasks above, the next steps in Entra include:
Additional group/provisioning configuration
Test and save after updating the config.
Provisioning after configuration is complete

SCIM provisioning
Cloudflare supports bulk provisioning of users into the Cloudflare dashboard by using the System for Cross-domain Identity Management (SCIM) protocol. This allows you to connect an external identity provider (IdP) to Cloudflare, quickly onboard and manage user permissions. Currently, SCIM provisioning has been integrated with Okta, Microsoft Entra, and Authentik.
:::note
This section covers SCIM provisioning for the Cloudflare dashboard. If you need to provision SCIM for Cloudflare Zero Trust, refer to Zero Trust SCIM provisioning.
:::
Objectives
Once the SCIM provisioning is enabled:
A Cloudflare account can receive user group provisioning from the identity provider.
Members of each user group can be assigned one or more policies. Each policy defines one or more roles applied to all group members thereof.
Members can belong to multiple user groups, and each group can also be configured with different policies.
Policies provisioned via SCIM can coexist with policies configured via the traditional setup.
Expected behaviors
Expectations for user lifecycle management with SCIM:
Expected Cloudflare dash behavior
Identity provider action
User is added to account as member
Assign the user to a SCIM application. They will be assigned the Minimal Account Access role so that their dash experience is not broken.
User is removed from account as member
Unassign the user from the SCIM application.
Add role to user
Add the user to a group in the IdP which is pushed via SCIM. They must also be assigned to the SCIM application and exist as an account member.
Remove role from user
Remove the user from the corresponding group in the IdP.
Retain user in account but with no permissions
Remove the user from all role groups but leave them assigned to the SCIM application. They will be an account member with only the role Minimal Account Access.
:::note
Dashboard SCIM handles group membership and user account lifecycle through separate services. Removing a user from a SCIM group updates their group membership in Cloudflare but has no effect on their account membership. Account membership removal requires the identity provider to send 
active: false in a 
PATCH /Users or 
PUT /Users request. Ensure your IdP is configured with the 
active attribute mapping. For Microsoft Entra ID, refer to Provision with Microsoft Entra.
:::
Limitations
If a user is the only Super Administrator on an Enterprise account, they will not be deprovisioned.
It is possible to unintentionally remove all account Super Administrators by misconfiguring SCIM groups. Refer to SCIM troubleshooting for more information.
SCIM group names cannot begin with the reserved prefix 
CF.
Prerequisites
Cloudflare dashboard SCIM provisioning is only available to Enterprise customers using Okta, Microsoft Entra, or Authentik.
You must be a Super Administrator for the initial setup.
In the identity provider, you must have the ability to create applications and groups.
Gather the required data
To start, you will need to collect a couple of pieces of data from Cloudflare and set these aside for later use.
Get the Account ID
The account ID can be found via dashboard or API. For more information, refer to Find account and zone IDs.
Create an API token
Create an API token with the following permissions:
Type
Item
Permission
Account
SCIM Provisioning
Edit
:::note
Account API tokens are recommended for SCIM Provisioning. User owned API tokens, while supported, may result in a broken SCIM connection in the event when the user's policies are revoked from the SCIM integration, or the API access is unexpectedly disabled. Learn more about Account API tokens.
:::
Under Account Resources, select the specific account to include or exclude from the dropdown menu, if applicable.
Select Continue to summary.
Validate the permissions and select Create Token.
Copy the token value.

Provision with Okta
Once you have gathered the required data, the following steps will be required to finish the provisioning with Okta.
Set up your Okta SCIM application
In the Okta dashboard, go to Applications > Applications.
Select Browse App Catalog.
Locate and select SCIM 2.0 Test App (OAuth Bearer Token).
Select Add Integration and name your integration.
Enable the following options:
Do not display application icon to users
Do not display application icon in the Okta Mobile App
Disable Automatically log in when user lands on login page.
Select Next, then select Done.
Integrate the Cloudflare API
:::note
The Update User Attributes option is not supported.
:::
In your integration page, go to Provisioning > Configure API Integration.
Enable Enable API Integration.
In SCIM 2.0 Base URL, enter: 
https://api.cloudflare.com/client/v4/accounts/<accountID>/scim/v2, substituting 
accountID for your Cloudflare Account ID.
In the OAuth Bearer Token field, enter your API token value.
Deselect Import Groups.
Configure user & group sync in Okta
In Provisioning to App, select Edit.
Enable Create Users and Deactivate Users. Select Save.
Select Done.
In the Assignments tab, add the users you want to synchronize with Cloudflare dashboard. You can add users in batches by assigning a group. If a user is removed from the application assignment via either direct user assignment or removed from the group that was assigned to the app, this will trigger a deprovisioning event from Okta to Cloudflare.
In the Push Groups tab, add the Okta groups you want to synchronize with Cloudflare dashboard. View these Okta groups in the dashboard under Manage Account > Manage members > Members > User Groups.
To verify the integration, select View Logs in the Okta SCIM application, and check the Audit Logs in the Cloudflare dashboard by navigating to Manage Account > Audit Log.
This will provision all of the users in the group(s) affected to your Cloudflare account with "minimal account access."

SCIM troubleshooting
If you have removed all Super Administrators mistakenly, you can restore the role to account member(s) using the Account API Token you created for SCIM provisioning.
First, fetch a list of account members and find the member ID for the user you want to restore Super Admin to via list members.
curl -X GET "https://api.cloudflare.com/client/v4/accounts/{account_id}/members" \
  -H "Authorization: Bearer YOUR_SCIM_AOT" \
  -H "Content-Type: application/json"
Then restore the Super Admin role to that member via update member
curl -X PUT "https://api.cloudflare.com/client/v4/accounts/{account_id}/members/{member_id}" \
  -H "Authorization: Bearer YOUR_SCIM_AOT" \
  -H "Content-Type: application/json" \
  -d '{
    "roles": [
      {
        "id": "33666b9c79b9a5273fc7344ff42f953d"
      }
    ]
  }'
The value 
33666b9c79b9a5273fc7344ff42f953d is the role ID of Super Administrator.
Update email domains after onboarding
We currently do not support updating email domains for users. This means that any SCIM 
PATCH/
PUT operations that change email domains will be rejected. We recommend not using the email as the matching attribute if email domains are expected to change, and restarting provisioning manually.

Cloudflare's API
Use the following resources to learn more about Cloudflare's REST API:

Troubleshooting
Ensure the token has been verified by running the following 
curl command and confirming that the response returns 
"status": "active".
curl "https://api.cloudflare.com/client/v4/user/tokens/verify" \
--header "Authorization: Bearer <API_TOKEN>"
{
  "success": true,
  "errors": [],
  "messages": [],
  "result": {
    "id": "f267e341f3dd4697bd3b9f71dd96247f",
    "status": "active",
    "not_before": "2018-07-01T05:20:00Z",
    "expires_on": "2020-01-01T00:00:00Z"
  }
}
The token has incorrect permissions
Review the permissions groups for your token in the Cloudflare dashboard. Refer to API token permissions for more information.
The incorrect syntax is used
Occasionally customers will attempt to use an API token with an API key syntax. Ensure you are using the Bearer option rather than the email and API key pair.
You have the incorrect user permissions
You cannot create a token that exceeds the permission granted to you on your account. For example, if you have been granted an Admin (Read only) role, you would need your Super Administrator to update your role so that you could create a token for yourself.

Account API tokens
While user tokens act on behalf of a particular user and inherit a subset of that user's permissions, account API tokens allow you to set up durable integrations that can act as service principals with their own specific set of permissions. This approach is ideal for scenarios like CI/CD, or building integrations with external services like SIEMs where it is important that the integration continues working, even long after the user who configured the integration may have left your organization altogether. User tokens are better for ad hoc tasks like scripting, where acting as the user is ideal and durability is less of a concern.
New account API tokens use the 
cfat_ prefixed scannable format, which allows credential scanning tools to detect leaked tokens.
Create an account owned token
In order to create account API tokens, members either require API Token Provisioning capabilities or Super Administrator status.
While Super Administrators can view and manage all account API tokens in a respective account, other members can only view and manage tokens which they created.
:::note
Account members may only grant account API tokens permissions which are a subset of their own account permissions.
:::
Log in to the Cloudflare dashboard and select your account.
Go to Manage account > Account API tokens.
Select Create Token and fill in the token name, permissions, and an optional expiration date.
Select Continue to summary and review the details.
Select Create Token.
Newly created account-owned tokens also contain helpful metadata regarding creator attribution and provisioning details.
Alternatively, you can create a token using the account API token creation API.
Refer to the blog post for more information.
Compatibility matrix
Account API tokens are generally available for all accounts. Some services may not support account API tokens yet. Refer to the compatibility matrix below for the latest status.
Product
Compatibility
Access
✅
Account Analytics
✅
Account Management
✅
AI Gateway
✅
API Shield
✅
Argo
✅
Billing
✅
Browser Run
✅
Bulk Redirects
✅
Cache
✅
Tiered Cache
✅
Client-side security (formerly Page Shield)
✅
Cloud Connector
✅
Configuration Rules
✅
Custom Lists
✅
Custom Pages
✅
D1
✅
Data Loss Prevention
✅
Digital Experience Monitoring
✅
Distributed Web
✅
DNS
✅
Durable Objects
✅
Email Relay
✅
Email Service
✅
Secure Web Gateway
✅
Healthchecks
✅
Hyperdrive
✅
Images
✅
Intel Data Platform
❌
Load Balancing
✅
Log Explorer
✅
Network Flow
✅
Magic Transit
✅
Cloudflare WAN
✅
Managed Rules
✅
Network Error Logging
✅
Page Rules
❌
Pages
✅
R2
✅
Radar
✅
Registrar
❌
Rulesets
✅
Spectrum
✅
Speed
✅
SSL/TLS
✅
Stream
✅
Super Bot Fight Mode
❌
Trace
✅
Tunnels
✅
Turnstile
❌
Vectorize
✅
Waiting Room
✅
Workers
✅
Workers AI
✅
Workers KV
✅
Workers Observability
✅
Workers Queues
✅
Workflows
✅
Zaraz
✅
Zero Trust Client Platform
❌
Zero Trust Devices and Services
✅
Zone/Domain Management
✅

Get Origin CA keys
:::caution[Deprecated]
Origin CA keys (Service Keys) are deprecated and will be removed on September 30, 2026. Use an API Token with 
Zone-
SSL and Certificates-
Edit permissions instead. For more information, refer to API deprecations.
:::
Origin CA keys are often used as the value of header 
X-AUTH-USER-SERVICE-KEY when interacting with Origin CA certificates API. It is also used by Keyless SSL key server.
The key value always starts with 
v1.0-.
Limitations
Changing the Origin CA key is not recorded by Audit Logs.
Each time you view the Origin CA key, it will be presented as a different value. All these different values are simultaneously valid until you click the 
Change button, which immediately invalidates all previously generated values.
Origin CA keys have access to every account the user has access to.
View/Change your Origin CA keys
To retrieve your Origin CA keys:
Log in to the Cloudflare dashboard.
https://dash.cloudflare.com/?to=/:account/home
Go to User Profile > API Tokens.
In the API Keys section, select 
Origin CA Key.

Create API token
:::note[Prerequisite]
Before you begin, find your zone and account IDs.
:::
Determine if you want a user token or an Account API token. Use Account API tokens if you prefer service tokens that are not associated with users and your desired API endpoints are compatible.
From the Cloudflare dashboard, go to My Profile > API Tokens for user tokens. For Account Tokens, go to Manage Account > API Tokens.
Select Create Token.
Select a template from the available API token templates or create a custom token. The following example uses the Edit zone DNS template.
Add or edit the token name to describe why or how the token is used. Templates are prefilled with a token name and permissions.
Modify the token's permissions. After selecting a permissions group (Account, User, or Zone), choose what level of access to grant the token. Most groups offer 
Edit or 
Read options. 
Edit is full CRUDL (create, read, update, delete, list) access, while 
Read is the read permission and list where appropriate. Refer to the available token permissions for more information.
Select which resources the token is authorized to access. For example, granting 
Zone DNS Read access to a zone 
example.com will allow the token to read DNS records only for that specific zone. Any other zone will return an error for DNS record reads operations. Any other operation on that zone will also return an error.
(Optional) Restrict how a token is used in the Client IP Address Filtering and TTL (time to live) fields.
Select Continue to summary.
Review the token summary. Select Edit token to make adjustments. You can also edit a token after creation.
Select Create Token to generate the token's secret.
Copy the secret to a secure place.
The token secret page also includes an example command to test the token. Use the 
/user/tokens/verify endpoint to fetch the current status of the given token.
curl "https://api.cloudflare.com/client/v4/user/tokens/verify" \
--header "Authorization: Bearer <API_TOKEN>"
The result:
{
	"result": {
		"id": "100bf38cc8393103870917dd535e0628",
		"status": "active"
	},
	"success": true,
	"errors": [],
	"messages": [
		{
			"code": 10000,
			"message": "This API Token is valid and active",
			"type": null
		}
	]
}
New API tokens use the 
cfut_ prefixed scannable format, which allows credential scanning tools to detect leaked tokens.
With this you have successfully created an API token and can start working with the Cloudflare API. After creating your first API token, you can create additional API tokens via the API.

Get started


Get Global API key (legacy)
Global API key is the previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API key.
New and rolled Global API Keys use the 
cfk_ prefixed scannable format, which allows credential scanning tools to detect leaked keys.
:::note
Global API key is only available after the account email address is verified.
:::
Limitations
Global API key has multiple limitations when compared to API tokens:
Access to all Cloudflare resources - Global API key has access to all of a user's resources. This makes it impossible to safely use Global API key to access non-production resources when a user also has access to production resources.
Full permissions - Similarly, Global API key has the exact same permissions as the user, which means if the user can delete zones or change DNS records, so can the Global API key.
Limited to one per user - Only one Global API key can be provisioned per user. This complicates using Cloudflare's API in production systems where maintaining two secrets for accessing the API is important in the case one needs to be rolled.
Lack of advanced limits on usage - API tokens can be limited to specific time windows and expire or be limited to use from specific IP ranges.
For these reasons, Global API key is not recommended for new customers. Current customers using Global API key are encouraged to migrate and use API tokens instead.
View your Global API key
To retrieve your Global API key:
In the Cloudflare dashboard, go to My Profile > API Tokens.
https://dash.cloudflare.com/profile/api-tokens
In the API Keys section, click 
View button of Global API Key.
Change your Global API key

Token formats
Cloudflare API keys and API tokens use a prefixed, scannable format that makes them identifiable by credential scanning tools. Each credential type in the following table has a distinct prefix followed by 40 characters and a checksum.
Credential type
Description
Format
Global API Key
Global key tied to your user account (full access)
cfk_[40 characters][checksum]
User API Token
Scoped token you create for specific permissions
cfut_[40 characters][checksum]
Account API Token
Token owned by the account, not tied to a specific user
cfat_[40 characters][checksum]
Existing tokens continue to work. Every new token you create or roll uses the scannable format automatically.
Leaked token detection
The prefixed format and checksum allow credential scanning tools to detect leaked Cloudflare tokens with high confidence. Cloudflare partners with credential scanning providers to proactively find your leaked tokens and revoke them before they can be used maliciously.
GitHub Secret Scanning
Cloudflare participates in GitHub's Secret Scanning program. GitHub scans every commit for Cloudflare API credentials in both public and private repositories.
Public repositories — When GitHub detects a leaked Cloudflare token, it verifies the token using the checksum and sends Cloudflare a webhook. Cloudflare automatically revokes the token and notifies you by email so you can generate a replacement.
Private repositories — GitHub notifies you about any leaked Cloudflare tokens so you can rotate them.
Pre-2026 formats
Tokens created before the scannable format was introduced use unprefixed strings. These tokens continue to work. Cloudflare scans for and revokes leaked tokens in both the old and new formats.
Credential type
Old format
Global API Key
37–45 character lowercase hex string
User API Token
40-character alphanumeric string
Account API Token
40-character alphanumeric string
Wrangler OAuth access tokens
When you authenticate with 
wrangler login, Wrangler receives a user OAuth access token that starts with 
cfoat_. Run 
wrangler auth token to retrieve the current token for use with another tool or script. The command automatically refreshes the token if it has expired.
Treat the returned value as a secret. Do not commit it to source control or share it.
Verify a token
To check that a user API token is valid, send it to the Verify Token endpoint:
https://api.cloudflare.com/client/v4/user/tokens/verify
If the token is valid, the response includes the token's 
id and a 
status of 
active.

API token template URLs
Use template URLs to generate Cloudflare API tokens with pre-configured permissions. Template URLs allow you to share token requirements with users without manually selecting permissions in the dashboard.
Template URLs use query parameters to pre-fill the API token creation page in the Cloudflare dashboard. When a user opens a template URL, the dashboard automatically configures the specified permissions and settings.
Cloudflare supports template URLs for both user API tokens and account API tokens. For more information on the difference between these token types, refer to Account API tokens.
:::note
Template URLs only pre-fill the token creation form. Users must still complete the token creation process in the dashboard.
:::
User token URL format
User token template URLs open the token creation form at the user profile level (
/profile/api-tokens). Tokens created this way are owned by the user.
The basic template URL structure is:
https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=[ENCODED_PERMISSIONS]&accountId=*&zoneId=all&name=[TOKEN_NAME]
URL components
Parameter
Required
Description
permissionGroupKeys
Yes
URL-encoded JSON array of permission objects
accountId
Yes
Account scope (use 
* for all accounts)
zoneId
Yes
Zone scope (use 
all for all zones)
name
No
Pre-filled token name
Account token URL format
Account token template URLs open the token creation form at the account level. Tokens created this way are owned by the account (service principal tokens) and are not tied to any individual user. Refer to Account API tokens for role and permission requirements.
The basic template URL structure is:
https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=[ENCODED_PERMISSIONS]&name=[TOKEN_NAME]
The 
:account segment is a placeholder. When a user opens the URL, the dashboard prompts them to select an account if they have access to more than one.
URL components
Parameter
Required
Description
permissionGroupKeys
Yes
URL-encoded JSON array of permission objects
name
No
Pre-filled token name
:::note
Account token template URLs do not use 
accountId or 
zoneId parameters. Resource scoping for account tokens is configured during token creation in the dashboard.
:::
Permission format
Both user token and account token template URLs use the same permission encoding: a JSON array with the following structure.
[{ "key": "permission_name", "type": "read|edit|revoke|run|purge" }]
The two token types resolve these entries differently, as described in the following sections.
For account token URLs, each 
key can be either a short permission key (for example, 
dns) or a permission group ID. Using the permission group ID is the most reliable option, since it maps to exactly one group. Refer to Use permission group IDs.
For user token URLs, each 
key must be a short permission key that matches a group 
name exactly, and the 
type must be 
edit (not 
write), 
read, 
revoke, 
run, or 
purge. Permission group IDs are not supported, and any entry that does not match is dropped silently.
Permission types
Type
Description
read
Read-only access
edit
Full access (create, read, update, delete)
revoke
Revoke permissions
run
Execute permissions
purge
Purge permissions
Use permission group IDs
:::note
Permission group IDs are supported in account token URLs only. User token URLs must use short keys.
:::
To address any permission group in an account token URL, including groups that do not have a short key in the permission reference, use its permission group ID as the 
key:
[{ "key": "82e64a83756745bbbb1c9c2701bf816b", "type": "edit" }]
Permission group IDs are the stable, canonical identifier for a permission group. They are the same IDs accepted by the Create token endpoint and the Cloudflare Terraform provider, so a template URL can pre-select any permission group by ID. Because the ID names one specific group, the 
type field is ignored when you pass an ID.
Combine multiple IDs in the same array, just as you would with short keys:
[
	{ "key": "e086da7e2179491d91ee5f35b3ca210a", "type": "edit" },
	{ "key": "7cf72faf220841aabcfdfab81c43c4f6", "type": "read" }
]
Because account token URLs create account-owned tokens, look up their permission group IDs with the account-scoped List permission groups endpoint. The request needs a token with the 
API Tokens Read account permission:
curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/tokens/permission_groups" \
	--header "Authorization: Bearer <API_TOKEN>"
For user tokens, use the user-scoped endpoint instead, which returns the permission groups available to user tokens:
curl "https://api.cloudflare.com/client/v4/user/tokens/permission_groups" \
	--header "Authorization: Bearer <API_TOKEN>"
Each result includes the permission group 
id and 
name. The API token permissions reference also lists these IDs.
Create custom templates
1. Identify required permissions
List the permissions your use case needs. Refer to the permission reference table.
2. Create the permission JSON
Format your permissions as a JSON array:
[
	{ "key": "dns", "type": "edit" },
	{ "key": "analytics", "type": "read" }
]
3. URL-encode the JSON
Use a URL encoder to convert the JSON string:
%5B%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22edit%22%7D%2C%7B%22key%22%3A%22analytics%22%2C%22type%22%3A%22read%22%7D%5D
4. Build the complete URL
For a user token, combine all components into the final template URL:
https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=[ENCODED_JSON]&accountId=*&zoneId=all&name=Custom%20Token
For an account token, use the account-level path instead:
https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=[ENCODED_JSON]&name=Custom%20Token
Permission reference
Use this table to find permission keys for your custom templates.
Account permissions
Permission key
Description
Common use cases
account_analytics
Account analytics
Reporting, monitoring
account_api_tokens
API token management
Token automation
account_settings
Account configuration
Account management
billing
Billing information
Cost tracking, invoicing
workers_scripts
Workers scripts
Serverless functions
workers_kv_storage
Workers KV storage
Data storage
workers_routes
Workers routes
Traffic routing
workers_r2
R2 storage
Object storage
d1
D1 database
SQL databases
queues
Queues
Message queuing
page
Cloudflare Pages
Page deployments
stream
Stream
Video streaming
images
Images
Image optimization
account_logs
Logs
Log management
Zone permissions
Permission key
Description
Common use cases
dns
DNS records
Domain management
zone
Zone management
Domain configuration
zone_settings
Zone settings
Zone configuration
analytics
Zone analytics
Performance monitoring
firewall_services
Firewall rules
Security management
page_rules
Page rules
Traffic control
cache
Cache purging
Content updates
ssl_and_certificates
SSL/TLS certificates
Certificate management
logs
Logs
Log management
Access permissions
Permission key
Description
Common use cases
access
Access applications
Zero Trust apps
access_acct
Access organizations
Identity management
access_audit_log
Access audit logs
Compliance, security
access_custom_page
Custom pages
Branding, user experience
teams
Zero Trust
Gateway, CASB, DLP
Common permission templates
Use these ready-to-use template URLs for common scenarios. Each example provides both a user token URL and an account token URL.
DNS management
Create tokens for DNS record management.
User token
Use case
Template URL
DNS read-only
https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=DNS%20Read%20Token
DNS read/write
https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22edit%22%7D%5D&accountId=%2A&zoneId=all&name=DNS%20Management%20Token
Account token
Use case
Template URL
DNS read-only
https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=%5B%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%5D&name=DNS%20Read%20Token
DNS read/write
https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=%5B%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22edit%22%7D%5D&name=DNS%20Management%20Token
Workers development
Create tokens for Workers, KV storage, and related services.
User token
Use case
Template URL
Workers scripts only
https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22workers_scripts%22%2C%22type%22%3A%22edit%22%7D%5D&accountId=%2A&zoneId=all&name=Workers%20Scripts%20Token
Workers full access
https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22workers_scripts%22%2C%22type%22%3A%22edit%22%7D%2C%7B%22key%22%3A%22workers_kv_storage%22%2C%22type%22%3A%22edit%22%7D%2C%7B%22key%22%3A%22workers_routes%22%2C%22type%22%3A%22edit%22%7D%5D&accountId=%2A&zoneId=all&name=Workers%20Full%20Access%20Token
Account token
Use case
Template URL
Workers scripts only
https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=%5B%7B%22key%22%3A%22workers_scripts%22%2C%22type%22%3A%22edit%22%7D%5D&name=Workers%20Scripts%20Token
Workers full access
https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=%5B%7B%22key%22%3A%22workers_scripts%22%2C%22type%22%3A%22edit%22%7D%2C%7B%22key%22%3A%22workers_kv_storage%22%2C%22type%22%3A%22edit%22%7D%2C%7B%22key%22%3A%22workers_routes%22%2C%22type%22%3A%22edit%22%7D%5D&name=Workers%20Full%20Access%20Token
Analytics and monitoring
Create tokens for accessing analytics and logs.
User token
Use case
Template URL
Account analytics
https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_analytics%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=Account%20Analytics%20Token
Zone analytics
https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22analytics%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=Zone%20Analytics%20Token
Account token
Use case
Template URL
Account analytics
https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=%5B%7B%22key%22%3A%22account_analytics%22%2C%22type%22%3A%22read%22%7D%5D&name=Account%20Analytics%20Token
Zone analytics
https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=%5B%7B%22key%22%3A%22analytics%22%2C%22type%22%3A%22read%22%7D%5D&name=Zone%20Analytics%20Token
Zero Trust administration
Create tokens for Cloudflare Zero Trust management.
User token
Use case
Template URL
Access applications read
https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22access%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=Access%20Read%20Token
Access full management
https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22access%22%2C%22type%22%3A%22edit%22%7D%2C%7B%22key%22%3A%22access_acct%22%2C%22type%22%3A%22edit%22%7D%5D&accountId=%2A&zoneId=all&name=Access%20Management%20Token
Account token
Use case
Template URL
Access applications read
https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=%5B%7B%22key%22%3A%22access%22%2C%22type%22%3A%22read%22%7D%5D&name=Access%20Read%20Token
Access full management
https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=%5B%7B%22key%22%3A%22access%22%2C%22type%22%3A%22edit%22%7D%2C%7B%22key%22%3A%22access_acct%22%2C%22type%22%3A%22edit%22%7D%5D&name=Access%20Management%20Token
Best practices
Follow these guidelines when creating and sharing template URLs.
Principle of least privilege: Only request the minimum permissions necessary for your use case. This reduces security risks if a token is compromised.
Use descriptive token names: Include clear, descriptive names in your template URLs to help users understand the token's purpose.
Document token usage: Provide clear documentation about what each token is used for and how to revoke it when no longer needed.
Regular token rotation: Encourage users to regularly rotate tokens and review permissions.
Test before sharing: Always test template URLs in a staging environment before sharing them with users.
Troubleshooting
Review the list of common issues and solutions.
Issue
Solution
URL does not pre-fill permissions
Verify the JSON is properly URL-encoded
Permissions are missing
Check permission keys against the reference table, or address the group by its permission group ID
Token name does not appear
Ensure the name parameter is URL-encoded
Access denied error
Verify the user has required permissions in their account
For account token URLs, when a template URL contains a key that cannot be resolved, or the 
permissionGroupKeys value is not valid JSON, the dashboard still opens the token creation form with whatever it could resolve and shows a notice naming the keys it could not apply. It does not redirect back to the token list, so a mistyped key surfaces in the form instead of failing silently.
For user token URLs, unresolved entries are dropped silently and no notice is shown, so verify each key against the permission reference before sharing the URL.
Additionally, review the checklist before sharing a template URL.
All permission keys are correct
JSON syntax is valid
URL encoding is proper
Token name is descriptive
Permissions follow least privilege principle
Related resources
API token permissions
Create API tokens
Account API tokens
API authentication

Control API Access
Super administrators of an Enterprise account are capable of selectively scoping the API access. API access can be restricted for the entire account or only for specified account members.
Note that the feature does not disable API calls not related to the Enterprise account.
Account-level access control
To restrict the API access for the entire account:
In the Cloudflare dashboard, go to the Members page.
https://dash.cloudflare.com/?to=/:account/members
Locate the Enable API Access section and then update the setting.
Member-level access control
:::note
Member-level settings will override the account-level setting. If a specific member has API access enabled whereas the account has the access disabled, that member can still call APIs related to the Enterprise account.
:::
To restrict the API access for a specific member:
In the Cloudflare dashboard, go to the Members page.
https://dash.cloudflare.com/?to=/:account/members
Click on the member to expand and choose the intended API Access. If 
Account Default, then it follows the account level setting.

Create tokens via API
Generate new API tokens on the fly via the API. Before you can do this, you must create an API token in the Cloudflare dashboard that can create subsequent tokens.
:::note
To create user-owned API tokens, use the Create additional tokens template. The User > API Tokens > Edit permission is not available in any other template or in the Custom Token builder.
:::
Generating the initial token
Before you can use the API, you need to generate an initial token via the Cloudflare dashboard. The required permission depends on the API operation. To grant users access to an account as members, create a token with Account > Account Settings > Edit. To create account-owned API tokens, create a token with Account > Account API Tokens > Edit. To create user-owned API tokens, use the Create additional tokens template.
Recommendations
When using the Create additional tokens template, Cloudflare highly recommends that you do not grant other permissions to the token. Make sure you safeguard the new token because it can create tokens with access to any of a user's resources.
Cloudflare also recommends limiting the use of the token via client IP address filtering or TTL to reduce the potential for abuse in the event that the token is compromised. Refer to Restrict token use for more information.
Creating API tokens with the API
You can create a user owned token or account owned token to use with the API. Refer to the user owned token or the account owned token API schema docs for more information.
To create a token:
Define the policy.
Define the restrictions.
Create the token.
1. Define the Access Policy
An Access Policy defines what resources the token can act on and what permissions the token has to those resources. This process is similar to how you create tokens in the Cloudflare dashboard.
Each token can contain multiple policies.
[
	{
		"id": "f267e341f3dd4697bd3b9f71dd96247f",
		"effect": "allow",
		"resources": {
			"com.cloudflare.api.account.zone.eb78d65290b24279ba6f44721b3ea3c4": "*",
			"com.cloudflare.api.account.zone.22b1de5f1c0e4b3ea97bb1e963b06a43": "*"
		},
		"permission_groups": [
			{
				"id": "c8fed203ed3043cba015a93ad1616f1f",
				"name": "Zone Read"
			},
			{
				"id": "82e64a83756745bbbb1c9c2701bf816b",
				"name": "DNS Read"
			}
		]
	}
]
Field
Description
id
Unique read-only identifier for the policy generated after creation.
effect
Defines whether this policy is allowing or denying access. If only creating one policy, use 
allow. The evaluation order for policies is as follows: 1. Explicit 
DENY Policies; 2. Explicit 
ALLOW Policies; 3. Implicit 
DENY ALL.
resources
Defines what resources are allowed to be configured.
permission_groups
Defines what permissions the policy grants to the included resources.
Resources
API token policies support three resource types: 
User, 
Account, and 
Zone.
:::note
Fetch each object's ID by calling the appropriate 
GET <object> API. Refer to User, Account, and Zone documentation for more details.
:::
Account
Include a single account or all accounts in a token policy.
A single account is denoted as:
"com.cloudflare.api.account.<ACCOUNT_ID>": "*".
All accounts is denoted as:
"com.cloudflare.api.account.*": "*"
Zone
Include a single zone, all zones in an account, or all zones in all accounts in a token policy.
A single zone is denoted as:
"com.cloudflare.api.account.zone.<ZONE_ID>": "*"
All Zones in an account are denoted as:
"com.cloudflare.api.account.<ACCOUNT_ID>": {"com.cloudflare.api.account.zone.*": "*"}
All zones in all accounts is denoted as:
"com.cloudflare.api.account.zone.*": "*"
User
For user resources, you can only reference yourself, which is denoted as:
"com.cloudflare.api.user.<USER_TAG>": "*"
Permission groups
Add permission groups to the API token by specifying their 
id values. We recommend using 
id as the key for interacting with Cloudflare APIs; the permission 
name is cosmetic and subject to change. Permission groups are scoped to specific resources (user, account, or zone), so a permission group in a policy will only apply to the resource type it is scoped for.
Use the permission-group endpoint for the token type you want to create:
Account owned token
Use the List permission groups endpoint. To help ensure you are only adding permission groups which are available through your membership policy, reference the 
is_selectable parameter present in each permission group.
GET /accounts/{account_id}/tokens/permission_groups
User owned token
Use the List permission groups endpoint.
GET /user/tokens/permission_groups
{
  "result": [
    {
      "id": "19637fbb73d242c0a92845d8db0b95b1",
      "name": "AI Crawl Control Read",
      "description": "Grants access to reading AI Crawl Control",
      "scopes": [
        "com.cloudflare.api.account.zone"
      ]
    },
    {
      "id": "1ba6ab4cacdb454b913bbb93e1b8cb8c",
      "name": "AI Crawl Control Write",
      "description": "Grants access to reading and editing AI Crawl Control",
      "scopes": [
        "com.cloudflare.api.account.zone"
      ]
    },
    // (...)
	]
}
2. Define the restrictions
Set up any limitations on how the token can be used. API tokens allow restrictions for client IP address filtering and TTLs. Refer to Restrict token use for more information.
When defining TTLs, you can set the time at which a token becomes active with 
not_before and the time when it expires with 
expires_on. Both of these fields take UTC timestamps in the following format: 
"2018-07-01T05:20:00Z".
Limit usage of a token by client IP address filters with the following object:
{
	"request.ip": {
		"in": ["199.27.128.0/21", "2400:cb00::/32"],
		"not_in": ["199.27.128.0/21", "2400:cb00::/32"]
	}
}
Each parameter in the 
in and 
not_in objects must be in CIDR notation. For example, use 
192.168.0.1/32 to specify a single IP address.
3. Create the token
Combine the previous information to create a token as in the following example:
Account token
curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/tokens" \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Content-Type: application/json" \
--data '{
  "name": "readonly token",
  "policies": [
    {
      "effect": "allow",
      "resources": {
        "com.cloudflare.api.account.zone.eb78d65290b24279ba6f44721b3ea3c4": "*",
        "com.cloudflare.api.account.zone.22b1de5f1c0e4b3ea97bb1e963b06a43": "*"
      },
      "permission_groups": [
        {
          "id": "c8fed203ed3043cba015a93ad1616f1f",
          "name": "Zone Read"
        },
        {
          "id": "82e64a83756745bbbb1c9c2701bf816b",
          "name": "DNS Read"
        }
      ]
    }
  ],
  "not_before": "2020-04-01T05:20:00Z",
  "expires_on": "2020-04-10T00:00:00Z",
  "condition": {
    "request.ip": {
      "in": [
        "199.27.128.0/21",
        "2400:cb00::/32"
      ],
      "not_in": [
        "199.27.128.1/32"
      ]
    }
  }
}'
User token
curl "https://api.cloudflare.com/client/v4/user/tokens" \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Content-Type: application/json" \
--data '{
  "name": "readonly token",
  "policies": [
    {
      "effect": "allow",
      "resources": {
        "com.cloudflare.api.account.zone.eb78d65290b24279ba6f44721b3ea3c4": "*",
        "com.cloudflare.api.account.zone.22b1de5f1c0e4b3ea97bb1e963b06a43": "*"
      },
      "permission_groups": [
        {
          "id": "c8fed203ed3043cba015a93ad1616f1f",
          "name": "Zone Read"
        },
        {
          "id": "82e64a83756745bbbb1c9c2701bf816b",
          "name": "DNS Read"
        }
      ]
    }
  ],
  "not_before": "2020-04-01T05:20:00Z",
  "expires_on": "2020-04-10T00:00:00Z",
  "condition": {
    "request.ip": {
      "in": [
        "199.27.128.0/21",
        "2400:cb00::/32"
      ],
      "not_in": [
        "199.27.128.1/32"
      ]
    }
  }
}'
curl "https://api.cloudflare.com/client/v4/user/tokens" \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Content-Type: application/json" \
--data '{
  "name": "readonly token",
  "policies": [
    {
      "effect": "allow",
      "resources": {
        "com.cloudflare.api.account.zone.eb78d65290b24279ba6f44721b3ea3c4": "*",
        "com.cloudflare.api.account.zone.22b1de5f1c0e4b3ea97bb1e963b06a43": "*"
      },
      "permission_groups": [
        {
          "id": "c8fed203ed3043cba015a93ad1616f1f",
          "name": "Zone Read"
        },
        {
          "id": "82e64a83756745bbbb1c9c2701bf816b",
          "name": "DNS Read"
        }
      ]
    }
  ],
  "not_before": "2020-04-01T05:20:00Z",
  "expires_on": "2020-04-10T00:00:00Z",
  "condition": {
    "request.ip": {
      "in": [
        "199.27.128.0/21",
        "2400:cb00::/32"
      ],
      "not_in": [
        "199.27.128.1/32"
      ]
    }
  }
}'

How to


Make API calls
Once you create your API token, all API requests are authorized in the same way. Cloudflare uses the RFC standard 
Authorization: Bearer <API_TOKEN> interface. An example request is shown below.
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID" \
--header "Authorization: Bearer YQSn-xWAQiiEh9qM58wZNnyQS7FUdoqGIUAbrh7T"
Never send or store your API token secret in plaintext. Also be sure not to check it into code repositories, especially public ones.
Consider defining environment variables for the zone or account ID, as well as for authentication credentials (for example, the API token).
To format JSON output for readability in the command line, you can use a tool like 
jq, a command-line JSON processor. For more information on obtaining and installing 
jq, refer to Download jq.
The following example will format the curl JSON output using 
jq:
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID" \
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" | jq .
Using Cloudflare's APIs
Every Cloudflare API element is fixed to a version number. The latest version is Version 4. The stable base URL for all Version 4 HTTPS endpoints is: 
https://api.cloudflare.com/client/v4/
For specific guidance on making API calls, refer to the following resources:
The product's Developer Docs section for how-to guides.
API schema docs for request and response payloads for each endpoint.
The first-party libraries for Go, TypeScript, Python, or HashiCorp's Terraform.
Query parameters
Several Cloudflare endpoints have optional query parameters to filter incoming results, such as List Zones.
When adding those query parameters, make sure you enclose the URL in double quotes 
"" (just like the header values), or the API call might error.
curl "https://api.cloudflare.com/client/v4/zones?account.id=$ACCOUNT_ID" \
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
You can enclose strings using either single quotes (
'') or double quotes (
""). However, using single quotes prevents variable substitution in shells like 
bash. In the previous example, this would mean that the 
$ACCOUNT_ID and 
$CLOUDFLARE_API_TOKEN environment variables would not be replaced with their values.
Pagination
Sometimes there will be too many results to display via the default page size, for example you might receive the following:
"count": 1,
"page": 1,
"per_page": 20,
"total_count": 200,
Two query parameter options exist, which can be combined to paginate across the results.
page=x enables you to select a specific page.
per_page=xx enables you to adjust the number of results displayed on a page. If you select too many, you may get a timeout.
An example might be 
https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records?per_page=100&page=2.
Other options are:
order: Select the attribute to order by.
direction: Either 
ASC (ascending order) or 
DESC (descending order).
The available options will be listed at the end of the 
result_info of all endpoints in the API documentation.
Making API calls on Windows
Recent versions of Windows 10 and 11 already include the curl tool used in the developer documentation's API examples. If you are using a different Windows version, refer to Windows downloads in the curl website for more information on obtaining and installing this tool.
Using a Command Prompt window
To use the Cloudflare API with curl on a Command Prompt window, you must use double quotes (
") as string delimiters.
A typical 
PATCH request will be similar to the following:
C:\>curl --request PATCH "https://api.cloudflare.com/client/v4/user/invites/{id}" --header "X-Auth-Email: <EMAIL>" --header "X-Auth-Key: <API_KEY>" --data "{""status"": ""accepted""}"
To escape a double quote character in a request body (for example, a body specified with 
-d or 
--data in a 
POST/
PATCH request), prepend it with another double quote (
") or a backslash (
\) character.
To break a single command in two or more lines, use 
^ as the line continuation character at the end of a line:
C:\>curl --request PATCH ^
"https://api.cloudflare.com/client/v4/user/invites/{id}" ^
--header "X-Auth-Email: <EMAIL>" ^
--header "X-Auth-Key: <API_KEY>" ^
--data "{""status"": ""accepted""}"
Using PowerShell
:::note
Cloudflare recommends that you use the most recent stable or preview version of PowerShell. For more information, refer to Installing PowerShell on Windows.
:::
PowerShell has specific cmdlets (
Invoke-RestMethod and 
ConvertFrom-Json) for making REST API calls and handling JSON responses. The syntax for these cmdlets is different from the curl examples provided in the developer documentation.
The following example uses the 
Invoke-RestMethod cmdlet:
Invoke-RestMethod -URI "https://api.cloudflare.com/client/v4/zones/$Env:ZONE_ID/ssl/certificate_packs?ssl_status=all" -Method 'GET' -Headers @{'X-Auth-Email'=$Env:CLOUDFLARE_EMAIL;'X-Auth-Key'=$Env:CLOUDFLARE_API_KEY}
result      : {@{id=78411cfa-5727-4dc1-8d4a-773d01f17c7c; type=universal; hosts=System.Object[];
              primary_certificate=c173c8a1-9724-4e96-a748-2c4494186098; status=active; certificates=System.Object[];
              created_on=2022-12-09T23:11:06.010263Z; validity_days=90; validation_method=txt;
              certificate_authority=lets_encrypt}}
result_info : @{page=1; per_page=20; total_pages=1; count=1; total_count=1}
success     : True
errors      : {}
messages    : {}
The command assumes that the environment variables 
ZONE_ID, 
CLOUDFLARE_EMAIL, and 
CLOUDFLARE_API_KEY have been previously defined. For more information, refer to Environment variables.
By default, the output will only contain the first level of the JSON object hierarchy (in the above example, the content of objects such as 
hosts and 
certificates is not shown). To show additional levels and format the output like the 
jq tool, you can use the 
ConvertFrom-Json cmdlet specifying the desired maximum depth (by default, 
2):
Invoke-RestMethod -URI "https://api.cloudflare.com/client/v4/zones/$Env:ZONE_ID/ssl/certificate_packs?ssl_status=all" -Method 'GET' -Headers @{'X-Auth-Email'=$Env:CLOUDFLARE_EMAIL;'X-Auth-Key'=$Env:CLOUDFLARE_API_KEY} | ConvertTo-Json -Depth 5
{
	"result": [
		{
			"id": "78411cfa-5727-4dc1-8d4a-773d01f17c7c",
			"type": "universal",
			"hosts": ["*.example.com", "example.com"],
			"primary_certificate": "c173c8a1-9724-4e96-a748-2c4494186098",
			"status": "active",
			"certificates": [
				{
					"id": "c173c8a1-9724-4e96-a748-2c4494186098",
					"hosts": ["*.example.com", "example.com"],
					"issuer": "LetsEncrypt",
					"signature": "ECDSAWithSHA384",
					"status": "active",
					"bundle_method": "ubiquitous",
					"zone_id": "<ZONE_ID>",
					"uploaded_on": "2023-02-02T11:20:25.403338Z",
					"modified_on": "2022-12-08T00:26:15.577555Z",
					"expires_on": "2023-03-07T23:26:12.000000Z",
					"priority": null
				}
			],
			"created_on": "2022-12-09T23:11:06.010263Z",
			"validity_days": 90,
			"validation_method": "txt",
			"certificate_authority": "lets_encrypt"
		}
	]
	// (...)
}
:::caution[ConvertFrom-Json handling of DateTime values]
The 
ConvertTo-Json cmdlet tries to convert strings formatted as timestamps to DateTime values, according to the exact format in the string. For details on this behavior, refer to the notes in the ConvertFrom-Json documentation.
:::
You can also use the curl tool in PowerShell. However, in PowerShell 
curl is an alias to the 
Invoke-WebRequest cmdlet, which supports a different syntax from the usual curl tool. To use curl, enter 
curl.exe instead.
A typical 
PATCH request with curl will be similar to the following:
curl.exe --request PATCH "https://api.cloudflare.com/client/v4/user/invites/{id}" --header "Authorization: Bearer $Env:CLOUDFLARE_API_TOKEN" --data '{\"status\": \"accepted\"}'
To escape a double quote (
") character in a request body (specified with 
-d or 
--data), prepend it with another double quote (
") or a backslash (
\). You must escape double quotes even when using single quotes (
') as string delimiters.
To break a single command in two or more lines, use a backtick (
`) character as the line continuation character at the end of a line:
curl.exe --request PATCH `
"https://api.cloudflare.com/client/v4/user/invites/{id}" `
--header "X-Auth-Email: $Env:CLOUDFLARE_EMAIL" `
--header "X-Auth-Key: $Env:CLOUDFLARE_API_KEY" `
--data '{\"status\": \"accepted\"}'
Environment variables
You can define environment variables for values that repeat between commands, such as the zone or account ID. The lifetime of an environment variable can be the current shell session, all future sessions of the current user, or even all future sessions of all users on the machine you are defining them.
You can also use environment variables for keeping authentication credentials (API token, API key, and email) and reusing them in different commands. However, make sure you define these values in the smallest possible scope (either the current shell session only or all new sessions for the current user).
The procedure for setting and referencing environment variables depends on your platform and shell.
Define an environment variable
Linux and macOS
To define a 
ZONE_ID environment variable for the current shell session, run the following command:
export ZONE_ID='f2ea6707005a4da1af1b431202e96ac5'
To define the variable for all new shell sessions for the current user, add the command above at the end of your shell configuration file (for example, 
~/.bashrc for the 
bash shell and 
~/.zshrc for the 
zsh shell).
PowerShell
To define a 
ZONE_ID environment variable for the current PowerShell session, run the following command:
$Env:ZONE_ID='f2ea6707005a4da1af1b431202e96ac5'
To define the environment variable for all new PowerShell sessions of the current user, set the variable in your PowerShell profile. You can get the path to your PowerShell profile by running 
echo $PROFILE.
Alternatively, set the variable for all new PowerShell sessions of the current user using the 
SetEnvironmentVariable() method of the 
System.Environment class. For example:
[Environment]::SetEnvironmentVariable("ZONE_ID", "f2ea6707005a4da1af1b431202e96ac5", "User")
Running this command will not affect the current session. You will need to close and start a new PowerShell session.
Windows Command Prompt
To define a 
ZONE_ID environment variable for the current Command Prompt session, run the following command:
set ZONE_ID=f2ea6707005a4da1af1b431202e96ac5
To define an environment variable for all future Command Prompt sessions of the current user, run the following command:
setx ZONE_ID f2ea6707005a4da1af1b431202e96ac5
Running this command will not affect the current window. You will need to either run the 
set command or close and start a new Command Prompt window.
Reference an environment variable
Linux and macOS
When referencing an environment variable in a command, add a 
$ prefix to the variable name (for example, 
$ZONE_ID). Make sure that the full string referencing the variable is either unquoted (if it does not contain spaces) or enclosed in double quotes (
"").
For example:
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID" \
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
PowerShell
When referencing an environment variable in a command, add an 
$Env: prefix to the variable name (for example, 
$Env:ZONE_ID). Make sure that the full string referencing the variable is either unquoted or enclosed in double quotes (
"").
For example:
Invoke-RestMethod -URI "https://api.cloudflare.com/client/v4/zones/$Env:ZONE_ID" -Method 'GET' -Headers @{'Authorization'="Bearer $Env:CLOUDFLARE_API_TOKEN"}
Windows Command Prompt
When referencing an environment variable in a command, enclose the variable name in 
% characters (for example, 
%ZONE_ID%).
For example:
curl "https://api.cloudflare.com/client/v4/zones/%ZONE_ID%" --header "Authorization: Bearer %CLOUDFLARE_API_TOKEN%"

Restrict tokens
API tokens can be restricted at runtime in two ways:
Client IP address range filtering
Time To Live (TTL) constraints
Client IP address range filtering
Client IP address restrictions control which IP addresses can make API requests with this token. By default, if no filtering is applied, all IP addresses can use the token. Once an 
Is in rule is applied, the token can only be used from the defined IP addresses. Define ranges with CIDR notation. To allow an IP range with exceptions, define 
Is not in to exempt specific IPs or smaller ranges.
:::note
Client IP address range filtering is not applied to the Verify Token endpoint.
:::
Time to live (TTL) constraints
By default, tokens do not expire and are long lived. Defining a TTL sets when a token starts being valid and when a token is no longer valid. This is often referred to as 
notBefore and 
notAfter. Setting these timestamps limits the lifetime of the token to the defined period. Not setting the start date or 
notBefore means the token is active as soon as it is created. Not setting the end date or 
notAfter means the token does not expire.
:::note
Dates selected are defined as 00:00 UTC of that day. For finer grained time selection, use the API.
:::

Roll tokens


API deprecations
Cloudflare occasionally makes updates to our APIs that result in behavior changes or deprecations. When this happens, we will communicate when the API will no longer be available and whether there will be a replacement.
:::note
Subscribe to all API deprecation posts via RSS.
:::
Related resources
Available RSS feeds (for the Cloudflare changelog)
Subscribe to Cloudflare Status
Planned maintenance windows

Reference


Rate limits
Rate limiting headers
The following headers are returned when calling REST APIs:
Ratelimit: List of service limit items, composed of the limit name, the remaining quota (
r) and the time next window resets (
t). For example: 
"default";r=50;t=30
Ratelimit-Policy: List of quota policy items, composed of the policy name, the total quota (
q) and the time window the quota applies to (
w). For example: 
"burst";q=100;w=60
retry-after: The number of seconds, rounded up, until more capacity is available. Note, this header is only returned when the request has exceeded the rate limit.
Cloudflare's SDKs will also automatically work with the headers and back off in response to rate limits.

API token permissions
Permissions are segmented into three categories based on resource:
Zone permissions
Account permissions
User permissions
Each category contains permission groups related to those resources. DNS permissions belong to the Zone category, while Billing permissions belong to the Account category. Below is a list of the available token permissions.
To obtain an updated list of token permissions, including the permission ID and the scope of each permission, use the List permission groups endpoint.
User permissions
The applicable scope of user permissions is 
com.cloudflare.api.user.
Dashboard
API
Account permissions
The applicable scope of account permissions is 
com.cloudflare.api.account.
:::note
The 
AI Gateway Read, 
Run, and 
Edit permissions are account-scoped only — they cannot be restricted to a single gateway. For details, refer to Authenticated Gateway.
:::
Dashboard
Name
Description
Access: Apps and Policies Read
Grants read access to Cloudflare Access applications and policies.
Access: Apps and Policies Revoke
Grants ability to revoke Cloudflare Access application tokens
Access: Apps and Policies Edit
Grants write access to Cloudflare Access applications and policies.
Access: Apps Read
Grants read access to Cloudflare Access applications.
Access: Apps Revoke
Grants ability to revoke Cloudflare Access application tokens.
Access: Apps Edit
Grants write access to Cloudflare Access applications.
Access: Audit Logs Read
Grants read access to Cloudflare Access authentication logs.
Access: Custom Pages Read
Grants read access to Cloudflare Access custom block pages.
Access: Custom Pages Edit
Grants write access to Cloudflare Access custom block pages.
Access: Device Posture Read
Grants read access to Cloudflare Access device posture.
Access: Device Posture Edit
Grants write access to Cloudflare Access device posture.
Access: Groups Read
Grants read access to Cloudflare Access rule groups.
Access: Groups Edit
Grants write access to Cloudflare Access rule groups.
Access: Identity Providers Read
Grants read access to Cloudflare One identity providers.
Access: Identity Providers Edit
Grants write access to Cloudflare One identity providers.
Access: Keys Read
Grants read access to Cloudflare Access signing keys.
Access: Keys Edit
Grants ability to rotate Cloudflare Access signing keys.
Access: Mutual TLS Certificates Read
Grants read access to Cloudflare Access mTLS certificates.
Access: Mutual TLS Certificates Edit
Grants write access to Cloudflare Access mTLS certificates.
Access: Organizations Read
Grants read access to Zero Trust Organization settings.
Access: Organizations Revoke
Grants ability to revoke user sessions in a Zero Trust organization.
Access: Organizations Edit
Grants write access to Zero Trust Organization settings.
Access: Organizations, Identity Providers, and Groups Read
Grants read access to Zero Trust Organization settings, Cloudflare One identity providers, and Cloudflare Access rule groups.
Access: Organizations, Identity Providers, and Groups Revoke
Grants ability to revoke users from your Zero Trust organization.
Access: Organizations, Identity Providers, and Groups Edit
Grants write access to Zero Trust Organization settings, Cloudflare One identity providers, and Cloudflare Access rule groups.
Access: Policies Read
Grants read access to Cloudflare Access policies.
Access: Policies Edit
Grants write access to Cloudflare Access policies.
Access: Policy Test Read
Grants read access to Cloudflare Access policy test results and status.
Access: Policy Test Edit
Grants access to test Cloudflare Access policies.
Access: Population Read
Grants read access to the SCIM users and groups synced from an identity provider to Cloudflare Access.
Access: Population Edit
Grants write access to the SCIM users and groups synced from an identity provider to Cloudflare Access.
Access: SCIM Logs Read
Grants read access to Cloudflare Access SCIM provisioning logs.
Access: Service Tokens Read
Grants read access to Cloudflare Access service tokens.
Access: Service Tokens Edit
Grants write access to Cloudflare Access service tokens.
Access: SSH Auditing Read
Grants read access to Cloudflare Access SSH CAs.
Access: SSH Auditing Edit
Grants write access to Cloudflare Access SSH CAs.
Access: Tags Read
Grants read access to Cloudflare Access tags.
Access: Tags Edit
Grants write access to Cloudflare Access tags.
Access: Users Read
Grants read access to users in a Zero Trust organization.
Access: Users Edit
Grants access to update a user's name in a Zero Trust organization.
Account Analytics Read
Grants read access to account analytics.
Account Custom Pages Read
Grants read access to account-level Error Pages.
Account Custom Pages Edit
Grants write access to account-level Error Pages.
Account Filter Lists Read
Grants read access to Account Filter Lists.
Account Filter Lists Edit
Grants write access to Account Filter Lists.
Account Firewall Access Rules Read
Grants read access to account firewall access rules.
Account Firewall Access Rules Edit
Grants write access to account firewall access rules.
Account Rulesets Read
Grants read access to Account Rulesets.
Account Rulesets Edit
Grants write access to Account Rulesets.
Account Security Center Insights
Grants read access to Security Center Insights.
Account Security Center Insights Edit
Grants write access to Security Center Insights.
Account Settings Read
Grants read access to Account resources, account membership, and account level features.
Account Settings Edit
Grants write access to Account resources, account membership, and account level features.
Account: SSL and Certificates Read
Grants read access to SSL and Certificates.
Account: SSL and Certificates Edit
Grants write access to SSL and Certificates.
Account WAF Read
Grants read access to Account WAF.
Account WAF Edit
Grants write access to Account WAF.
Address Maps Edit
Grants write access to Address Maps
Address Maps Read
Grants read access to Address Maps
Address Maps Read
Grants read access to Address Maps
AI Gateway Edit
Grants edit access to AI Gateway
AI Gateway Read
Grants read access to AI Gateway
AI Gateway Run
Grants run access to Non-realtime WebSockets API
Allow Request Tracer Read
Grants read access to Request Tracer.
API Gateway Read
Grants read access to API Gateway (including API Shield) for all domains in an account.
API Gateway Edit
Grants write access to API Gateway (including API Shield) for all domains in an account.
Billing Read
Grants read access to billing profile, subscriptions, and access to fetch invoices and entitlements.
Billing Edit
Grants write access to billing profile, subscriptions, and access to fetch invoices and entitlements.
Bulk URL Redirects Read
Grants read access to Bulk Redirects.
Bulk URL Redirects Edit
Grants write access to Bulk Redirects.
China Network Steering Read
Grants read access to China Network Steering.
China Network Steering Edit
Grants write access to China Network Steering.
Cloudchamber Read
Grants read access to Cloudchamber deployments.
Cloudchamber Edit
Grants write access to Cloudchamber deployments.
Cloudflare Realtime Read
Grants read access to Cloudflare Realtime.
Cloudflare Realtime Edit
Grants write access to Cloudflare Realtime.
Cloudflare CASB Read
Grants read access to Cloud Access Security Broker.
Cloudflare CASB Edit
Grants write access to Cloud Access Security Broker.
Cloudflare DEX Read
Grants read access to Digital Experience Monitoring.
Cloudflare DEX Edit
Grants write access to Digital Experience Monitoring.
Cloudflare Images Read
Grants read access to Cloudflare Images.
Cloudflare Images Edit
Grants write access to Cloudflare Images.
Cloudflare One Connector: cloudflared Read
Grants read access to 
cloudflared connectors
Cloudflare One Connector: cloudflared Edit
Grants write access to 
cloudflared connectors
Cloudflare One Connector: WARP Read
Grants read access to Cloudflare Mesh nodes
Cloudflare One Connector: WARP Edit
Grants write access to Cloudflare Mesh nodes
Cloudflare One Connectors Read
Grants read access to Cloudflare One connectors
Cloudflare One Connectors Edit
Grants write access to Cloudflare One connectors
Cloudflare One Networks Read
Grants read access to Cloudflare One routes and virtual networks
Cloudflare One Networks Edit
Grants write access to Cloudflare One routes and virtual networks
Cloudflare Pages Read
Grants access to view Cloudflare Pages projects.
Cloudflare Pages Edit
Grants access to create, edit and delete Cloudflare Pages projects.
Cloudflare Tunnel Read
Grants access to view Cloudflare Tunnels.
Cloudflare Tunnel Edit
Grants access to create and delete Cloudflare Tunnels.
Cloudforce One Read
Grants read access to Cloudforce One.
Cloudforce One Edit
Grants write access to Cloudforce One.
Email Security Read
Grants read access to Cloud Email Security.
Email Security Edit
Grants write access to Email Security.
Constellation Read
Grants read access to Constellation.
Constellation Edit
Grants write access to Constellation.
Containers Read
Grants read access to Containers.
Containers Edit
Grants write access to Containers.
D1 Read
Grants read access to D1.
D1 Edit
Grants write access to D1.
DDoS Botnet Feed Read
Grants read access to Botnet Feed reports.
DDoS Botnet Feed Edit
Grants write access to Botnet Feed configuration.
DDoS Protection Read
Grants read access to DDoS protection.
DDoS Protection Edit
Grants write access to DDoS protection.
DNS Firewall Read
Grants read access to DNS Firewall.
DNS Firewall Edit
Grants write access to DNS Firewall.
Email Routing Addresses Read
Grants read access to Email Routing Addresses.
Email Routing Addresses Edit
Grants write access to Email Routing Addresses.
Hyperdrive Read
Grants read access to Hyperdrive.
Hyperdrive Edit
Grants write access to Hyperdrive.
Intel Read
Grants read access to Intel.
Intel Edit
Grants write access to Intel.
Integration Edit
Grants write access to integrations.
IOT Read
Grants read access to IOT.
IOT Edit
Grants write access to IOT.
IP Prefixes: Read
Grants access to read IP prefix settings.
IP Prefixes: Edit
Grants access to read/write IP prefix settings.
IP Prefixes: BGP On Demand Read
Grants access to read IP prefix BGP configuration.
IP Prefixes: BGP On Demand Edit
Grants access to read and change IP prefix BGP configuration.
L3/4 DDoS Managed Ruleset Read
Grants read access to L3/4 DDoS managed ruleset.
L3/4 DDoS Managed Ruleset Edit
Grants write access to L3/4 DDoS managed ruleset.
Load Balancing: Monitors and Pools Read
Grants read access to account level load balancer resources.
Load Balancing: Monitors and Pools Edit
Grants write access to account level load balancer resources.
Logs Read
Grants read access to logs using Logpull or Instant Logs.
Logs Edit
Grants read and write access to Logpull, Logpush, and Instant Logs.
Magic Firewall Read
Grants read access to Cloudflare Network Firewall.
Magic Firewall Edit
Grants write access to Cloudflare Network Firewall.
Magic Firewall Packet Captures Read
Grants read access to Packet Captures.
Magic Firewall Packet Captures Edit
Grants write access to Packet Captures.
Magic Network Monitoring Read
Grants read access to Network Flow.
Magic Network Monitoring Edit
Grants write access to Network Flow.
Magic Transit Read
Grants read access to manage a user's Magic Transit prefixes.
Magic Transit Edit
Grants write access to manage a user's Magic Transit prefixes.
Notifications Read
Grants read access to Notifications.
Notifications Edit
Grants write access to Notifications.
Client-side security Read
Grants read access to client-side security (previously known as Page Shield).
Client-side security Edit
Grants write access to client-side security (previously known as Page Shield).
Workers Pipelines Read
Grants read access to Basin Pipelines.
Workers Pipelines Edit
Grants write access to Basin Pipelines.
Queues Read
Grants read access to Queues.
Queues Edit
Grants write access to Queues.
Rule Policies Read
Grants read access to Rule Policies.
Rule Policies Edit
Grants write access to Rule Policies.
Stream Read
Grants read access to Cloudflare Stream.
Stream Edit
Grants write access to Cloudflare Stream.
Transform Rules Read
Grants read access to Transform Rules.
Transform Rules Edit
Grants write access to Transform Rules.
Turnstile Read
Grants read access to Turnstile.
Turnstile Edit
Grants write access to Turnstile.
URL Scanner Read
Grants read access to URL Scanner.
URL Scanner Edit
Grants write access to URL Scanner.
Vectorize Read
Grants read access to Vectorize.
Vectorize Edit
Grants write access to Vectorize.
Workers AI Read
Grants read access to Workers AI.
Workers AI Edit
Grants write access to Workers AI.
Workers CI Read
Grants read access to Workers CI.
Workers CI Edit
Grants write access to Workers CI.
Workers KV Storage Read
Grants read access to Cloudflare Workers KV Storage.
Workers KV Storage Edit
Grants write access to Cloudflare Workers KV Storage.
Workers R2 Storage Read
Grants read access to Cloudflare R2 Storage.
Workers R2 Storage Edit
Grants write access to Cloudflare R2 Storage.
Workers Scripts Read
Grants read access to Cloudflare Workers scripts.
Workers Scripts Edit
Grants write access to Cloudflare Workers scripts.
Workers Tail Read
Grants 
wrangler tail read permissions.
Zero Trust Read
Grants read access to Cloudflare Zero Trust resources.
Zero Trust Report
Grants reporting access to Cloudflare Zero Trust.
Zero Trust Edit
Grants write access to Cloudflare Zero Trust resources.
Zero Trust: PII Read
Grants read access to Cloudflare Zero Trust PII.
Zero Trust: Seats Edit
Grants write access to the number of Zero Trust seats your organization can use (and be billed for).
API
Name
Description
Access: Apps and Policies Read
Grants read access to Cloudflare Access applications and policies.
Access: Apps and Policies Revoke
Grants ability to revoke Cloudflare Access application tokens
Access: Apps and Policies Write
Grants write access to Cloudflare Access applications and policies.
Access: Apps Read
Grants read access to Cloudflare Access applications.
Access: Apps Revoke
Grants ability to revoke Cloudflare Access application tokens.
Access: Apps Write
Grants write access to Cloudflare Access applications.
Access: Audit Logs Read
Grants read access to Cloudflare Access authentication logs.
Access: Custom Pages Read
Grants read access to Cloudflare Access custom block pages.
Access: Custom Pages Write
Grants write access to Cloudflare Access custom block pages.
Access: Device Posture Read
Grants read access to Cloudflare Access device posture.
Access: Device Posture Write
Grants write access to Cloudflare Access device posture.
Access: Groups Read
Grants read access to Cloudflare Access rule groups.
Access: Groups Write
Grants write access to Cloudflare Access rule groups.
Access: Identity Providers Read
Grants read access to Cloudflare One identity providers.
Access: Identity Providers Write
Grants write access to Cloudflare One identity providers.
Access: Keys Read
Grants read access to Cloudflare Access signing keys.
Access: Keys Write
Grants ability to rotate Cloudflare Access signing keys.
Access: Mutual TLS Certificates Read
Grants read access to Cloudflare Access mTLS certificates.
Access: Mutual TLS Certificates Write
Grants write access to Cloudflare Access mTLS certificates.
Access: Organizations Read
Grants read access to Zero Trust Organization settings.
Access: Organizations Revoke
Grants ability to revoke user sessions in a Zero Trust organization.
Access: Organizations Write
Grants write access to Zero Trust Organization settings.
Access: Organizations, Identity Providers, and Groups Read
Grants read access to Zero Trust Organization settings, Cloudflare One identity providers, and Cloudflare Access rule groups.
Access: Organizations, Identity Providers, and Groups Revoke
Grants ability to revoke users from your Zero Trust organization.
Access: Organizations, Identity Providers, and Groups Write
Grants write access to Zero Trust Organization settings, Cloudflare One identity providers, and Cloudflare Access rule groups.
Access: Policies Read
Grants read access to Cloudflare Access policies.
Access: Policies Write
Grants write access to Cloudflare Access policies.
Access: Policy Test Read
Grants read access to Cloudflare Access policy test results and status.
Access: Policy Test Write
Grants access to test Cloudflare Access policies.
Access: Population Read
Grants read access to the SCIM users and groups synced from an identity provider to Cloudflare Access.
Access: Population Write
Grants write access to the SCIM users and groups synced from an identity provider to Cloudflare Access.
Access: SCIM Logs Read
Grants read access to Cloudflare Access SCIM provisioning logs.
Access: Service Tokens Read
Grants read access to Cloudflare Access service tokens.
Access: Service Tokens Write
Grants write access to Cloudflare Access service tokens.
Access: SSH Auditing Read
Grants read access to Cloudflare Access SSH CAs.
Access: SSH Auditing Write
Grants write access to Cloudflare Access SSH CAs.
Access: Tags Read
Grants read access to Cloudflare Access tags.
Access: Tags Write
Grants write access to Cloudflare Access tags.
Access: Users Read
Grants read access to users in a Zero Trust organization.
Access: Users Write
Grants access to update a user's name in a Zero Trust organization.
Account Analytics Read
Grants read access to account analytics.
Account Custom Pages Read
Grants read access to account-level Error Pages.
Account Custom Pages Write
Grants write access to account-level Error Pages.
Account Rule Lists Read
Grants read access to Account Filter Lists.
Account Rule Lists Write
Grants write access to Account Filter Lists.
Account Firewall Access Rules Read
Grants read access to account firewall access rules.
Account Firewall Access Rules Write
Grants write access to account firewall access rules.
Account Rulesets Read
Grants read access to Account Rulesets.
Account Rulesets Write
Grants write access to Account Rulesets.
Account Security Center Insights
Grants read access to Security Center Insights.
Account Security Center Insights Write
Grants write access to Security Center Insights.
Account Settings Read
Grants read access to Account resources, account membership, and account level features.
Account Settings Write
Grants write access to Account resources, account membership, and account level features.
Account: SSL and Certificates Read
Grants read access to SSL and Certificates.
Account: SSL and Certificates Write
Grants write access to SSL and Certificates.
Account WAF Read
Grants read access to Account WAF.
Account WAF Write
Grants write access to Account WAF.
Address Maps Write
Grants write access to Address Maps
Address Maps Read
Grants read access to Address Maps
Address Maps Read
Grants read access to Address Maps
AI Gateway Edit
Grants edit access to AI Gateway
AI Gateway Read
Grants read access to AI Gateway
AI Gateway Run
Grants run access to Non-realtime WebSockets API
Allow Request Tracer Read
Grants read access to Request Tracer.
Account API Gateway Read
Grants read access to API Gateway (including API Shield) for all domains in an account.
Account API Gateway Write
Grants write access to API Gateway (including API Shield) for all domains in an account.
Billing Read
Grants read access to billing profile, subscriptions, and access to fetch invoices and entitlements.
Billing Write
Grants write access to billing profile, subscriptions, and access to fetch invoices and entitlements.
Mass URL Redirects Read
Grants read access to Bulk Redirects.
Mass URL Redirects Write
Grants write access to Bulk Redirects.
China Network Steering Read
Grants read access to China Network Steering.
China Network Steering Write
Grants write access to China Network Steering.
Cloudchamber Read
Grants read access to Cloudchamber deployments.
Cloudchamber Write
Grants write access to Cloudchamber deployments.
Realtime Read
Grants read access to Cloudflare Realtime.
Realtime Write
Grants write access to Cloudflare Realtime.
Cloudflare CASB Read
Grants read access to Cloud Access Security Broker.
Cloudflare CASB Write
Grants write access to Cloud Access Security Broker.
Cloudflare DEX Read
Grants read access to Digital Experience Monitoring.
Cloudflare DEX Write
Grants write access to Digital Experience Monitoring.
Images Read
Grants read access to Cloudflare Images.
Images Write
Grants write access to Cloudflare Images.
Cloudflare One Connector: cloudflared Read
Grants read access to 
cloudflared connectors
Cloudflare One Connector: cloudflared Write
Grants write access to 
cloudflared connectors
Cloudflare One Connector: WARP Read
Grants read access to Cloudflare Mesh nodes
Cloudflare One Connector: WARP Write
Grants write access to Cloudflare Mesh nodes
Cloudflare One Connectors Read
Grants read access to Cloudflare One connectors
Cloudflare One Connectors Write
Grants write access to Cloudflare One connectors
Cloudflare One Networks Read
Grants read access to Cloudflare One routes and virtual networks
Cloudflare One Networks Write
Grants write access to Cloudflare One routes and virtual networks
Pages Read
Grants access to view Cloudflare Pages projects.
Pages Write
Grants access to create, edit and delete Cloudflare Pages projects.
Cloudflare Tunnel Read
Grants access to view Cloudflare Tunnels.
Cloudflare Tunnel Write
Grants access to create and delete Cloudflare Tunnels.
Cloudforce One Read
Grants read access to Cloudforce One.
Cloudforce One Write
Grants write access to Cloudforce One.
Cloud Email Security: Read
Grants read access to Cloud Email Security.
Cloud Email Security: Write
Grants write access to Email Security.
Constellation Read
Grants read access to Constellation.
Constellation Write
Grants write access to Constellation.
Containers Read
Grants read access to Containers.
Containers Write
Grants write access to Containers.
D1 Read
Grants read access to D1.
D1 Write
Grants write access to D1.
DDoS Botnet Feed Read
Grants read access to Botnet Feed reports.
DDoS Botnet Feed Write
Grants write access to Botnet Feed configuration.
DDoS Protection Read
Grants read access to DDoS protection.
DDoS Protection Write
Grants write access to DDoS protection.
DNS Firewall Read
Grants read access to DNS Firewall.
DNS Firewall Write
Grants write access to DNS Firewall.
Email Routing Addresses Read
Grants read access to Email Routing Addresses.
Email Routing Addresses Write
Grants write access to Email Routing Addresses.
Hyperdrive Read
Grants read access to Hyperdrive.
Hyperdrive Write
Grants write access to Hyperdrive.
Intel Read
Grants read access to Intel.
Intel Write
Grants write access to Intel.
Integration Write
Grants write access to integrations.
IOT Read
Grants read access to IOT.
IOT Write
Grants write access to IOT.
IP Prefixes: Read
Grants access to read IP prefix settings.
IP Prefixes: Write
Grants access to read/write IP prefix settings.
IP Prefixes: BGP On Demand Read
Grants access to read IP prefix BGP configuration.
IP Prefixes: BGP On Demand Write
Grants access to read and change IP prefix BGP configuration.
L4 DDoS Managed Ruleset Read
Grants read access to L3/4 DDoS managed ruleset.
L4 DDoS Managed Ruleset Write
Grants write access to L3/4 DDoS managed ruleset.
Load Balancing: Monitors and Pools Read
Grants read access to account level load balancer resources.
Load Balancing: Monitors and Pools Write
Grants write access to account level load balancer resources.
Logs Read
Grants read access to logs using Logpull or Instant Logs.
Logs Write
Grants read and write access to Logpull, Logpush, and Instant Logs.
Magic Firewall Read
Grants read access to Cloudflare Network Firewall.
Magic Firewall Write
Grants write access to Cloudflare Network Firewall.
Magic Firewall Packet Captures - Read PCAPs API
Grants read access to Packet Captures.
Magic Firewall Packet Captures - Write PCAPs API
Grants write access to Packet Captures.
Magic Network Monitoring Read
Grants read access to Network Flow.
Magic Network Monitoring Write
Grants write access to Network Flow.
Magic Transit Read
Grants read access to manage a user's Magic Transit prefixes.
Magic Transit Write
Grants write access to manage a user's Magic Transit prefixes.
Notifications Read
Grants read access to Notifications.
Notifications Write
Grants write access to Notifications.
Page Shield Read
Grants read access to client-side security (previously known as Page Shield).
Page Shield Write
Grants write access to client-side security (previously known as Page Shield).
Pipelines Read
Grants read access to Basin Pipelines.
Pipelines Write
Grants write access to Basin Pipelines.
Queues Read
Grants read access to Queues.
Queues Write
Grants write access to Queues.
Rule Policies Read
Grants read access to Rule Policies.
Rule Policies Write
Grants write access to Rule Policies.
Stream Read
Grants read access to Cloudflare Stream.
Stream Write
Grants write access to Cloudflare Stream.
Transform Rules Read
Grants read access to Transform Rules.
Transform Rules Write
Grants write access to Transform Rules.
Turnstile Read
Grants read access to Turnstile.
Turnstile Write
Grants write access to Turnstile.
URL Scanner Read
Grants read access to URL Scanner.
URL Scanner Write
Grants write access to URL Scanner.
Vectorize Read
Grants read access to Vectorize.
Vectorize Write
Grants write access to Vectorize.
Workers AI Read
Grants read access to Workers AI.
Workers AI Write
Grants write access to Workers AI.
Workers CI Read
Grants read access to Workers CI.
Workers CI Write
Grants write access to Workers CI.
Workers KV Storage Read
Grants read access to Cloudflare Workers KV Storage.
Workers KV Storage Write
Grants write access to Cloudflare Workers KV Storage.
Workers R2 Storage Read
Grants read access to Cloudflare R2 Storage.
Workers R2 Storage Write
Grants write access to Cloudflare R2 Storage.
Workers Scripts Read
Grants read access to Cloudflare Workers scripts.
Workers Scripts Write
Grants write access to Cloudflare Workers scripts.
Workers Tail Read
Grants 
wrangler tail read permissions.
Zero Trust Read
Grants read access to Cloudflare Zero Trust resources.
Zero Trust Report
Grants reporting access to Cloudflare Zero Trust.
Zero Trust Write
Grants write access to Cloudflare Zero Trust resources.
Zero Trust: PII Read
Grants read access to Cloudflare Zero Trust PII.
Zero Trust: Seats Write
Grants write access to the number of Zero Trust seats your organization can use (and be billed for).
Zone permissions
The applicable scope of zone permissions is 
com.cloudflare.api.account.zone.
Dashboard
Name
Description
Access: Apps and Policies Read
Grants read access to Cloudflare Access zone resources.
Access: Apps and Policies Revoke
Grants ability to revoke all tokens to Cloudflare Access zone resources.
Access: Apps and Policies Edit
Grants write access to Cloudflare Access zone resources.
Analytics Read
Grants read access to analytics.
API Gateway Read
Grants read access to API Gateway zone resources.
API Gateway Edit
Grants write access to API Gateway zone resources.
Apps Edit
Grants full access to Cloudflare Apps (deprecated, refer to Workers instead).
Bot Management Read
Grants read access to Bot Management.
Bot Management Edit
Grants write access to Bot Management.
Bot Management Feedback Read
Grants read access to Bot Management feedback.
Bot Management Feedback Edit
Grants write access to Bot Management feedback.
Cache Purge
Grants access to purge cache.
Cache Rules Read
Grants read access to Cache Rules.
Cache Rules Edit
Grants write access to Cache Rules.
Cloud Connector Read
Grants read access to Cloud Connector rules.
Cloud Connector Edit
Grants write access to Cloud Connector rules.
Config Rules Read
Grants read access to Configuration Rules.
Config Rules Edit
Grants write access to Configuration Rules.
Custom Error Rules Read
Grants read access to Custom Error Rules.
Custom Error Rules Edit
Grants write access to Custom Error Rules.
Custom Pages Read
Grants read access to Custom Error Pages.
Custom Pages Edit
Grants write access to Custom Error Pages.
Dmarc Management Read
Grants read access to DMARC Management.
Dmarc Management Edit
Grants write access to DMARC Management.
DNS Read
Grants read access to DNS.
DNS Write
Grants write access to DNS.
Email Routing Rules Read
Grants read access to Email Routing Rules.
Email Routing Rules Edit
Grants write access to Email Routing Rules.
Firewall Services Read
Grants read access to Firewall resources.
Firewall Services Edit
Grants write access to Firewall resources.
Health Checks Read
Grants read access to Health Checks.
Health Checks Edit
Grants write access to Health Checks.
HTTP DDoS Managed Ruleset Read
Grants read access to HTTP DDoS managed ruleset.
HTTP DDoS Managed Ruleset Edit
Grants write access to HTTP DDoS managed ruleset.
Load Balancers Read
Grants read access to load balancer resources.
Load Balancers Edit
Grants write access to load balancer resources.
Logs Read
Grants read access to logs using Logpull.
Logs Edit
Grants write access to Logpull and Logpush.
Managed Headers Read
Grants read access to Managed Headers.
Managed Headers Edit
Grants write access to Managed Headers.
Zone Observability Read
Grants read access to Cloudflare Traces.
Zone Observability Edit
Grants write access to Cloudflare Traces.
Origin Rules Read
Grants read access to Origin Rules.
Origin Rules Edit
Grants write access to Origin Rules.
Page Rules Read
Grants read access to Page Rules.
Page Rules Edit
Grants write access to Page Rules.
Client-side security Read
Grants read access to client-side security (previously known as Page Shield).
Client-side security Edit
Grants write access to client-side security (previously known as Page Shield).
Response Compression Read
Grants read access to Response Compression.
Response Compression Edit
Grants write access to Response Compression.
Sanitize Read
Grants read access to sanitization.
Sanitize Edit
Grants write access to sanitization.
Single Redirect Read
Grants read access to zone-level Single Redirects.
Single Redirect Edit
Grants write access to zone-level Single Redirects.
SSL and Certificates Read
Grants read access to SSL configuration and certificate management.
SSL and Certificates Edit
Grants write access to SSL configuration and certificate management.
Transform Rules Read
Grants read access to Transform Rules.
Transform Rules Edit
Grants write access to Transform Rules.
Waiting Room Read
Grants read access to Waiting Room.
Waiting Room Edit
Grants write access to Waiting Room.
Web3 Hostnames Read
Grants read access to Web3 Hostnames.
Web3 Hostnames Edit
Grants write access to Web3 Hostnames.
Workers Routes Read
Grants read access to Cloudflare Workers and Workers KV Storage.
Workers Routes Edit
Grants write access to Cloudflare Workers and Workers KV Storage.
Zaraz Read
Grants read access to Zaraz zone level settings.
Zaraz Edit
Grants write access to Zaraz zone level settings.
Zone Read
Grants read access to zone management.
Zone Edit
Grants write access to zone management.
Zone Security Center Insights
Grants read access to zone level Security Center Insights.
Zone Security Center Insights Edit
Grants write access to zone level Security Center Zone Insights.
Zone Settings Read
Grants read access to zone settings.
Zone Settings Edit
Grants write access to zone settings.
Zone Versioning Read
Grants read access to Zone Versioning at zone level.
Zone Versioning Edit
Grants write access to Zone Versioning at zone level.
Zone WAF Read
Grants read access to Zone WAF.
Zone WAF Edit
Grants write access to Zone WAF.
API
Name
Description
Access: Apps and Policies Read
Grants read access to Cloudflare Access zone resources.
Access: Apps and Policies Revoke
Grants ability to revoke all tokens to Cloudflare Access zone resources.
Access: Apps and Policies Write
Grants write access to Cloudflare Access zone resources.
Analytics Read
Grants read access to analytics.
Domain API Gateway Read
Grants read access to API Gateway zone resources.
Domain API Gateway Write
Grants write access to API Gateway zone resources.
Apps Write
Grants full access to Cloudflare Apps (deprecated, refer to Workers instead).
Bot Management Read
Grants read access to Bot Management.
Bot Management Write
Grants write access to Bot Management.
Bot Management Feedback Read
Grants read access to Bot Management feedback.
Bot Management Feedback Write
Grants write access to Bot Management feedback.
Cache Purge
Grants access to purge cache.
Cache Settings Read
Grants read access to Cache Rules.
Cache Settings Write
Grants write access to Cache Rules.
Cloud Connector Read
Grants read access to Cloud Connector rules.
Cloud Connector Write
Grants write access to Cloud Connector rules.
Config Settings Read
Grants read access to Configuration Rules.
Config Settings Write
Grants write access to Configuration Rules.
Custom Errors Read
Grants read access to Custom Error Rules.
Custom Errors Write
Grants write access to Custom Error Rules.
Custom Pages Read
Grants read access to Custom Error Pages.
Custom Pages Write
Grants write access to Custom Error Pages.
Email Security DMARC Reports Read
Grants read access to DMARC Management.
Email Security DMARC Reports Write
Grants write access to DMARC Management.
DNS Read
Grants read access to DNS.
DNS Write
Grants write access to DNS.
Email Routing Rules Read
Grants read access to Email Routing Rules.
Email Routing Rules Write
Grants write access to Email Routing Rules.
Firewall Services Read
Grants read access to Firewall resources.
Firewall Services Write
Grants write access to Firewall resources.
Health Checks Read
Grants read access to Health Checks.
Health Checks Write
Grants write access to Health Checks.
HTTP DDoS Managed Ruleset Read
Grants read access to HTTP DDoS managed ruleset.
HTTP DDoS Managed Ruleset Write
Grants write access to HTTP DDoS managed ruleset.
Load Balancers Read
Grants read access to load balancer resources.
Load Balancers Write
Grants write access to load balancer resources.
Logs Read
Grants read access to logs using Logpull.
Logs Write
Grants write access to Logpull and Logpush.
Managed headers Read
Grants read access to Managed Headers.
Managed headers Write
Grants write access to Managed Headers.
Zone Observability Read
Grants read access to Cloudflare Traces.
Zone Observability Write
Grants write access to Cloudflare Traces.
Origin Read
Grants read access to Origin Rules.
Origin Write
Grants write access to Origin Rules.
Page Rules Read
Grants read access to Page Rules.
Page Rules Write
Grants write access to Page Rules.
Domain Page Shield Read
Grants read access to client-side security (previously known as Page Shield).
Domain Page Shield Write
Grants write access to client-side security (previously known as Page Shield).
Response Compression Read
Grants read access to Response Compression.
Response Compression Write
Grants write access to Response Compression.
Sanitize Read
Grants read access to sanitization.
Sanitize Write
Grants write access to sanitization.
Dynamic URL Redirects Read
Grants read access to zone-level Single Redirects.
Dynamic URL Redirects Write
Grants write access to zone-level Single Redirects.
SSL and Certificates Read
Grants read access to SSL configuration and certificate management.
SSL and Certificates Write
Grants write access to SSL configuration and certificate management.
Zone Transform Rules Read
Grants read access to Transform Rules.
Zone Transform Rules Write
Grants write access to Transform Rules.
Waiting Rooms Read
Grants read access to Waiting Room.
Waiting Rooms Write
Grants write access to Waiting Room.
Web3 Hostnames Read
Grants read access to Web3 Hostnames.
Web3 Hostnames Write
Grants write access to Web3 Hostnames.
Workers Routes Read
Grants read access to Cloudflare Workers and Workers KV Storage.
Workers Routes Write
Grants write access to Cloudflare Workers and Workers KV Storage.
Zaraz Read
Grants read access to Zaraz zone level settings.
Zaraz Write
Grants write access to Zaraz zone level settings.
Zone Read
Grants read access to zone management.
Zone Write
Grants write access to zone management.
Zone Security Center Insights
Grants read access to zone level Security Center Insights.
Zone Security Center Insights Write
Grants write access to zone level Security Center Zone Insights.
Zone Settings Read
Grants read access to zone settings.
Zone Settings Write
Grants write access to zone settings.
Zone Versioning Read
Grants read access to Zone Versioning at zone level.
Zone Versioning Write
Grants write access to Zone Versioning at zone level.
Zone WAF Read
Grants read access to Zone WAF.
Zone WAF Write
Grants write access to Zone WAF.

SDKs
Cloudflare offers language software development kits (SDKs) as well as 
curl examples to demonstrate how to use the Cloudflare API. The SDK libraries allow you to interact with the Cloudflare API in language-specific syntax and more easily integrate with your existing applications.
Cloudflare currently offers the following SDKs:
Go
TypeScript
Python
When to use cURL vs SDK
There is no definite answer on which you should use. Instead, consider your use case and determine whether cURL or an SDK is the best fit.
Use case
cURL
SDK
Quick testing within the CLI
✅
❌
Use within bash scripts or CI
✅
❌*
Usage from within an existing application or framework
❌
✅
More complex usage where you need to chain together outputs
❌
✅
* It is possible, although not straight forward, to use the SDKs within bash scripts or CI environments with additional runtime dependencies and setup.
Example
The following are examples of how you would query all of the Cloudflare zones you have access to.
With cURL:
curl "https://api.cloudflare.com/client/v4/zones" \
--header "Authorization: Bearer <API_TOKEN>"
With the TypeScript SDK:
const client = new Cloudflare({
	apiToken: process.env["CLOUDFLARE_API_TOKEN"],
});
const zones = await client.zones.list();
console.log(zones);

API token templates
Below is a table of the currently available API token templates and the default token permissions they grant. You can start creating a token with one of these templates and modify the permissions and resources from there.
	
		
			
Template Name
			
Permission
			
Resource
		
		
			
Edit Zone DNS
			
DNS Write
			
Zone
		
		
			
Read billing info
			
Billing Read
			
Account
		
		
			
Account resources: Include all accounts
			
		
		
			
Read analytics and logs
			
Analytics Read
			
Zone
		
		
			
Logs Read
			
Zone
		
		
			
Edit Cloudflare Workers
			
Workers Routes Write
			
Zone
		
		
			
Workers Scripts Write
			
Account
		
		
			
Workers KV Storage Write
			
Account
		
		
			
Workers Tail Read
			
Account
		
		
			
Workers R2 Storage Write
			
Account
		
		
			
Account Settings Read
			
Account
		
		
			
User Details Read
			
User
		
		
			
User Memberships Read
			
User
		
		
			
Edit load balancing configuration
			
Load Balancing: Monitors and Pools Write
			
Account
		
		
			
Load Balancers Write
			
Zone
		
		
			
WordPress
			
Analytics Read
			
Zone
		
		
			
Zone Read
			
Zone
		
		
			
Zone Settings Write
			
Zone
		
		
			
Account Settings Read
			
Account
		
		
			
DNS Read
			
Zone
		
		
			
Cache Purge
			
Zone
		
		
			
Account resources: Include all accounts
			
		
		
			
Zone resources: Include all zones
			
		
		
			
Create Additional Tokens
			
API Tokens Write
			
User
		
		
			
Read All Resources
			
				(All read permissions)
			
			
Account, Zone, User
		
		
			
Account resources: Include all accounts
			
		
		
			
Zone resources: Include all zones

Accounts, zones, and profiles
Within the Cloudflare ecosystem, there are three organizing concepts that control where specific settings live: user profiles, accounts, and zones.
flowchart LR
accTitle: Accounts contain zones and user profiles contain user settings
subgraph Account
    subgraph Zone - example.com
        A[WAF]
        B[DNS]
    end
    subgraph Zone - example2.com
        C[Cache rules]
        D[Waiting Room]
    end
    Workers
    K[Account members]
end
subgraph User profile
    G[Email address]
    H[Language]
    I[Communication preferences]
end
User profiles
Accounts
An account refers to an organization account, which contains one or more users and zones. Users can belong to multiple accounts, and each account maintains its own settings, including billing profiles, account members, lists, and other configurations.
Several account-level products - such as Workers, Pages, Security Center, and Bulk redirects - can affect some or all zones contained within that account.
After you log in and select an account - but before you select a zone - the sidebar will list account-level products.
When you log into the Cloudflare dashboard, you can access all accounts where your user is a member. To access account settings and account-level products from within a zone, use the Accounts option from the navigation sidebar.
Zones
Domains (or subdomains) that are added to Cloudflare become zones[^1], which have a direct impact on the security and performance of your website, application, or API. Use your zone to monitor security and performance, update configurations, and apply zone-level products and services.
Zone-level services - such as Load Balancers and Cache rules - only affect your website, application, or API for that zone and not other zones, even if they are contained within the same account.
When you log into the Cloudflare dashboard and choose an account, you can view a list of all zones within that account.
Once you are within a zone, items within the sidebar will be zone-related products. If you need to change to another zone, use the forward arrow next to the zone name or by go back to the homepage of your account.
[^1]: Similar to DNS zones, but with additional capabilities.

Cloudflare IP addresses
When you add a domain to Cloudflare and proxy its DNS records, visitors who look up your domain receive a Cloudflare IP address instead of your origin server's real IP address. This hides your origin server's IP address and allows Cloudflare to optimize, cache, and protect all requests before forwarding them to you.
Cloudflare has several IP address ranges which are shared by all proxied hostnames. Together, these IP addresses form the backbone of Cloudflare's anycast network — a routing method where the same IP address is announced from data centers worldwide, so each visitor's request is routed to a nearby data center.
:::note
Cloudflare uses other IP ranges for various products and services, but these addresses will not make connections to your origin.
:::
Allow Cloudflare IP addresses
All traffic to proxied DNS records passes through Cloudflare before reaching your origin server. This means that your origin server will stop receiving traffic from individual visitor IP addresses and instead receive traffic from Cloudflare IP addresses, which are shared by all proxied hostnames.
To your origin server's firewall, this can look like a limited number of sources sending a high volume of traffic — which may trigger automatic blocking or rate limiting. Because all visitor traffic appears to come from Cloudflare IP addresses, blocking these IPs — even accidentally — will prevent visitor traffic from reaching your application.
The guidance above applies to domains that use Cloudflare's HTTP proxy. Magic Transit works differently — instead of proxying web requests, it protects entire IP networks at the network layer. Cloudflare announces your IP address ranges (prefixes) via BGP so that all traffic destined for your network passes through Cloudflare for inspection and DDoS filtering before being forwarded to your infrastructure.
Configure origin server
Allowlist Cloudflare IP addresses
To avoid blocking Cloudflare IP addresses unintentionally, you also want to allow Cloudflare IP addresses at your origin web server.
You can explicitly allow these IP addresses with a .htaccess file or by using iptables.
The following example demonstrates how you could use an iptables rule to allow a Cloudflare IP address range. Replace 
$ip below with one of the Cloudflare IP address ranges. You will need to run this command once for each IP range listed on that page.
# For IPv4 addresses
iptables -I INPUT -p tcp -m multiport --dports http,https -s $ip -j ACCEPT
# For IPv6 addresses
ip6tables -I INPUT -p tcp -m multiport --dports http,https -s $ip -j ACCEPT
For more specific guidance, contact your hosting provider or website administrator.
Block other IP addresses (recommended)
If someone discovers your origin server's IP address — for example, through historical DNS records or mail server configuration — they could send traffic directly to your server, bypassing Cloudflare's security protections entirely. To prevent this, block all traffic that does not come from Cloudflare IP addresses or the IP addresses of your trusted partners, vendors, or applications.
For example, you might update your iptables with the following commands:
# For IPv4 addresses
iptables -A INPUT -p tcp -m multiport --dports http,https -j DROP
# For IPv6 addresses
ip6tables -A INPUT -p tcp -m multiport --dports http,https -j DROP
For more specific guidance, contact your hosting provider or website administrator.
Review external tools
To avoid blocking Cloudflare IP addresses unintentionally, review your external tools to check that:
Any security plugins — such as those for WordPress — allow Cloudflare IP addresses.
The ModSecurity plugin is up to date.
Further protection
For further recommendations on securing your origin server, refer to our guide on protecting your origin server.
Customize Cloudflare IP addresses
Enterprise customers who do not want to use Cloudflare IP addresses — which are shared by all proxied hostnames — have two potential alternatives:
Bring Your Own IP (BYOIP): Cloudflare announces your IPs (an IP address range you lease/own) in all of our locations.
Static IP addresses: Cloudflare sets static IP addresses for your domain. For more details, contact your account team.
Business and Enterprise customers can also reduce the number of Cloudflare IPs that their domain shares with other Cloudflare customer domains by uploading a Custom SSL certificate.
IP range updates
Cloudflare's IP ranges do not change frequently. When they do change, they are added to our list of IP ranges before being put into production. You can also use the Cloudflare API to programmatically keep your configuration updated.
AWS VPC routing conflict with Cloudflare IP ranges
Cloudflare uses 172.64.0.0/13 (172.64.0.0–172.71.255.255) as public egress IP space. This range is not RFC 1918 private space. RFC 1918 covers 172.16.0.0/12 (172.16.0.0–172.31.255.255), which does not overlap with 172.64.0.0/13.
AWS VPC route tables sometimes include a route covering 
172.16.0.0/12 (or a broader supernet such as 
172.16.0.0/8) for Transit Gateway or VPN connectivity. If this route points to an internal target rather than an Internet Gateway, it can capture Cloudflare's 172.64.x.x traffic before it reaches the Internet Gateway, causing connection errors (521, 522) from Cloudflare data centers that use this range.
To resolve:
Check your AWS VPC route table for any route covering a 
172.x.x.x range that routes to an internal target (Transit Gateway, VPN Gateway, NAT Gateway, or VPC peering connection).
Add a more-specific route with destination 
172.64.0.0/13 targeting your Internet Gateway. More-specific routes take precedence in AWS routing.
Alternatively, narrow the broad route to exactly 
172.16.0.0/12 (the RFC 1918 range), which does not include 172.64.0.0/13.
This issue does not appear in security group audits because security groups are evaluated at the instance level, not the routing layer.

How Cloudflare DNS works
To optimize your website or web application, Cloudflare provides DNS and CDN services, so we can reverse proxy the web traffic to and from your domain.
DNS explained
The Domain Name System (DNS) acts as the Internet's phonebook, translating domain names (for example, 
cloudflare.com) into numerical Internet Protocol (IP) addresses (for example, 
103.21.244.0).
The IP address is like a home address of where a website lives, and the domain name is the human-readable name.
A DNS query is like asking for directions to a place, and the DNS records are the source-of-truth for what exists where. DNS records live in authoritative DNS servers and provide information about a domain, such as the IP addresses of the servers that host the web content and services on that domain. With this information, Internet browsers know where to find a website or app, so they can render it for visitors using HTTP.
Cloudflare as a DNS provider
When you onboard your website or application to Cloudflare, Cloudflare becomes the primary authoritative DNS provider for your domain. As the primary authoritative DNS provider, Cloudflare responds to DNS queries for your domain, and you manage your domain's DNS records via the Cloudflare dashboard or API.
:::note
Cloudflare only becomes the primary authoritative DNS provider when you use the default, full DNS setup. For alternative options, refer to DNS setups.
:::
If your domain's status is active and the queried DNS record is set to 
proxied, Cloudflare responds with an anycast IP address, instead of the origin IP address defined in your DNS table.
Your domain status is active when your nameservers are updated to point to Cloudflare and have been authenticated. The proxy status defines how Cloudflare treats queries for specific DNS records. The anycast IP address is used to distribute traffic amongst Cloudflare's network, which protects your website or app from DDoS and other attacks, while optimizing site speed.
Cloudflare as a reverse proxy
A reverse proxy is a network of servers that sits in front of web servers and either forwards requests to those web servers, or handles requests on behalf of the web servers. Reverse proxies are typically implemented to help increase security, performance, and reliability of websites and web applications.
When Cloudflare receives a DNS query for your domain, the response is determined by the configuration set in your DNS table, including the type of the record, the record's proxy eligibility, and its proxy status.
When DNS records in your DNS table have a 
proxied status, the record's HTTP/HTTPS traffic will route through Cloudflare on its way between the client and the origin server. If the domain's status is active, all HTTP/HTTPS requests for proxied DNS records route through Cloudflare.
Using Cloudflare as a reverse proxy has several benefits, including:
Load balancing A reverse proxy can provide a load balancing solution which distributes incoming traffic evenly among different servers to prevent any single server from becoming overloaded. In the event that a server fails completely, other servers can step up to handle the traffic.
Protection from attacks. With a reverse proxy in place, a web site or service never needs to reveal the IP address of their origin servers, which makes it much harder for attackers to leverage a targeted attack against them, such as a DDoS attack. Instead the attackers will only be able to target the reverse proxy, such as Cloudflare's CDN, which will have tighter security and more resources to fend off a cyber attack.
Caching. A reverse proxy can also cache content, resulting in faster performance. For example, if a user in Paris visits a reverse-proxied website with web servers in Los Angeles, the user might actually connect to a local reverse proxy server in Paris, which will then have to communicate with an origin server in L.A. The proxy server can then cache (or temporarily save) the response data. Subsequent Parisian users who browse the site will then get the locally cached version from the Parisian reverse proxy server, resulting in much faster performance.
SSL encryption. SSL/TLS is essential. Without an SSL/TLS certificate, your visitors will find a warning on their browser stating your website or application is not secure. However, encrypting and decrypting SSL (or TLS) communications for each client can be computationally expensive for an origin server. A reverse proxy can be configured to decrypt all incoming requests and encrypt all outgoing responses, freeing up valuable resources on the origin server.

Concepts


Traffic flow through Cloudflare
Internet traffic is made up of people, services, and agents requesting online resources from wherever they are hosted. Your resources may be publicly available, like a website or application that anyone on the Internet can access. Or your resources may be privately available, like an internal app or network that only your employees and partners should be able to access.
Both public and private resources can be connected to the Cloudflare network to ensure only good actors can access what they are supposed to be able to access with high performance.
For example, you may not always want the direct traffic because it can come from malicious sources, like hackers, or in the form of DDoS attacks. Additionally, depending on the location where the request originated, you want to ensure the traffic is routed through the most efficient and fastest path.
Cloudflare's network
Cloudflare's global network, coupled with Anycast IP addressing, ensures that requests are handled by a Cloudflare server that is as close to the source as possible.
If you want to protect your traffic and ensure it travels efficiently, you need to configure Cloudflare to be in front of whatever you are trying to protect, such as your application, service, or server. How you put your resources behind Cloudflare's network will depend on the type of traffic and how you want to control it.
:::note
Cloudflare supports all HTTP methods, with the exception of 
CONNECT, 
TRACE, and 
PURGE, which are restricted. Requests that use restricted methods are not proxied through Cloudflare's network. Note that other Cloudflare products may apply different restrictions on HTTP methods, and behavior can vary depending on the service.
:::
On-ramp and off-ramp traffic
Traffic that enters Cloudflare's network is referred to as "on-ramping," and traffic that exits Cloudflare's network is referred to as "off-ramping." You may also know this as ingress and egress or "routing your traffic" through a network.
On-ramp traffic to Cloudflare
When you on-ramp traffic to Cloudflare, this allows Cloudflare to act on, secure, and increase performance of that traffic.
One example of on-ramping traffic to Cloudflare is updating your public website to use Cloudflare as the primary authoritative DNS provider for your domain.
However, maybe you need to protect a private application that is not directly available on the Internet. In this scenario, you can:
Connect your private application to Cloudflare using secure tunnels, and use a device agent to connect as a user.
For users already connected to a private company network, connect the entire network to Cloudflare using secure tunnels, and any request from a user device will access the private application through those tunnels.
With these options, any request from a user device can access internal private applications via the secure private tunnels.
Refer to the list below for products you can use to on-ramp traffic to Cloudflare.
Anycast routing uses Anycast IP addressing to route traffic to the nearest Cloudflare data center. Selective routing allows an Anycast network to be resilient in the face of high traffic volume, network congestion, and DDoS attacks.
DNS-based traffic resolves domains onboarded to Cloudflare's CDN. Cloudflare's DNS directs traffic to Cloudflare's global network of servers instead of a website's origin server.
Cloudflare Tunnel connects your resources to Cloudflare without a publicly routable IP address so that your origins can serve traffic through Cloudflare without being vulnerable to attacks that bypass Cloudflare.
Magic Transit offers DDoS protection, traffic acceleration, and more for on-premise, cloud-hosted, and hybrid networks by accepting IP packets destined for your network, processing them, and outputting the packets to your origin infrastructure.
The Cloudflare One Client securely and privately sends traffic from corporate devices to Cloudflare's global network while also applying advanced Zero Trust policies that check for a device's health before it connects to corporate applications.
Off-ramp traffic from Cloudflare
If you need to ensure traffic leaves Cloudflare's network in a specific way, you can manage how traffic is off-ramped.
For example, if you need to adhere to regional laws that dictate user traffic and require data never leaves your country, you can configure off-ramp and on-ramp traffic on servers in the same geographical area.
Or maybe you want to force traffic to off-ramp in a certain country to maintain your user's experience. For example, if you have employees in India who travel frequently, you can configure the off-ramp traffic to always appear to come from India so websites they visit maintain their language and preferences.
You can also utilize caching to help with performance. Instead of off-ramp traffic going to a server across the globe, Cloudflare can cache that content locally for the user to reduce the overall time for their request.
Refer to the list below for products you can use to off-ramp traffic from Cloudflare.
Argo Smart Routing detects real-time network issues and routes your web traffic across the most efficient network path, avoiding congestion.
Cache works with cached content to avoid off-ramping to origin servers and instead serving directly from Cloudflare's global network.
Regional services lets you choose which subset of data centers decrypt and service HTTPS traffic, which can help customers who have to meet regional compliance or have preferences for maintaining regional control over their data.

Add multiple sites via automation
To add multiple sites to Cloudflare at once and more efficiently, you can do so via the Cloudflare API.
Adding multiple sites can be useful when you:
Have multiple domains mapping back to a single, canonical domain (common for domains in different countries - such as 
.com.au, 
.co.uk - that you want protected by Cloudflare).
Are a partner, agency, or IT consultancy, and manage multiple domains on behalf of your customers.
Are moving an existing set of sites over to Cloudflare.
Using the API will allow you to add multiple sites quickly and efficiently, especially if you are already familiar with how to change your nameservers or add a DNS record.
This tutorial assumes domains will be added using a primary DNS setup (full).
Prerequisites
To add multiple sites to Cloudflare via automation, you need:
An existing Cloudflare account.
Command line with 
curl
A Cloudflare API token with one of the following permissions:
Zone-level 
Administrator
Zone-level 
Zone: Edit and 
DNS: Edit
Account-level 
Domain Administrator
To have disabled DNSSEC for each domain at your registrar (where you bought your domain name).
1. Add domains
Create a list of domains you want to add, each on a separate line (newline separated), stored in a file such as 
domains.txt.
Create a bash script 
add-multiple-zones.sh and add the following. Add 
domains.txt to the same directory or update its path accordingly.
  for domain in $(cat domains.txt); do
    printf "Adding ${domain}:\n"
    curl https://api.cloudflare.com/client/v4/zones \
    --header "Authorization: Bearer <API_TOKEN>" \
    --header "Content-Type: application/json" \
    --data '{
      "account": {
        "id":"<ACCOUNT_ID>"
      },
      "name": "'"$domain"'",
      "type": "full"
    }'
    printf "\n\n"
  done
Open the command line and run:
bash add-multiple-zones.sh
:::caution
There are limitations on the number of domains you can add at a time. Refer to limitations for details.
:::
After adding a domain, it will be in a 
Pending Nameserver Update state.
Additional options
jq
jq is a command-line tool that parses and beautifies JSON outputs.
This tool is a requirement to complete any additional option steps in this tutorial.
echo '{"foo":{"bar":"foo","testing":"hello"}}' | jq .
Refer to 
jq documentation for more information.
Quick scan
Cloudflare offers a quick scan that helps populate a zone's DNS records. This scan is a best effort attempt based on a predefined list of commonly used record names and types.
This API call requires the domain ID. This can be found in the following locations:
Create Zone
List Zones
Using 
jq with the first option above, modify your script 
add-multiple-zones.sh to extract the domain ID and run a subsequent API call to quick scan DNS records.
  for domain in $(cat domains.txt); do
    printf "Adding ${domain}:\n"
    add_output=`curl https://api.cloudflare.com/client/v4/zones \
      --header "Authorization: Bearer <API_TOKEN>" \
      --header "Content-Type: application/json" \
      --data '{
        "account": {
          "id":"<ACCOUNT_ID>"
        },
        "name": "'"$domain"'",
        "type": "full"
      }'`
    echo $add_output | jq .
    domain_id=`echo $add_output | jq -r .result.id`
    printf "\n\n"
    printf "DNS quick scanning ${domain}:\n"
    scan_output=`curl --request POST https://api.cloudflare.com/client/v4/zones/$domain_id/dns_records/scan \
      --header "X-Auth-Email: <EMAIL>" \
      --header "X-Auth-Key: <API_KEY>"`
    echo $scan_output | jq .
  done
2. Update nameservers
For each domain to become active on Cloudflare, it must be activated in either Full setup or Partial setup. The following script will output a list containing the nameservers associated with each domain.
You can find your zones nameservers in the following locations:
Create Zone
Zone Details
Modify your script 
add-multiple-zones.sh to print a CSV with data from the 
Create Zone JSON response.
  for domain in $(cat domains.txt); do
    printf "Adding ${domain}:\n"
    add_output=`curl https://api.cloudflare.com/client/v4/zones \
      --header "Authorization: Bearer <API_TOKEN>" \
      --header "Content-Type: application/json" \
      --data '{
        "account": {
          "id": "<ACCOUNT_ID>"
        },
        "name": "'"$domain"'",
        "type": "full"
      }'`
    # Create csv of nameservers
    echo $add_output | jq -r '[.result.name,.result.id,.result.name_servers[]] | @csv' >> /tmp/domain_nameservers.csv
    domain_id=`echo $add_output | jq -r .result.id`
    printf "\n\n"
    printf "DNS quick scanning ${domain}:\n"
    scan_output=`curl --request POST https://api.cloudflare.com/client/v4/zones/$domain_id/dns_records/scan \
      --header "X-Auth-Email: <EMAIL>" \
      --header "X-Auth-Key: <API_KEY>"`
    echo $scan_output | jq .
  done
  printf "name_servers are saved in /tmp/domain_nameservers"
  cat /tmp/domain_nameservers.csv
ID
ZONE
NAME SERVERS
<ZONE_ID>
example.com
arya.ns.cloudflare.com, 
tim.ns.cloudflare.com
Use the values in the NAME SERVERS column to update the nameservers at the registrar of each domain.
Limitations
There are limitations on the number of domains you can add at a time - specifically, you can only sign up a maximum of 25 domains every 10 minutes.
In addition, if you have over 50 domains and, of those domains, more are pending than active, you will be blocked from adding more. We recommend waiting until your pending sites have been activated before adding more.
Common issues
If any errors were returned in this process, the domain may not be registered (or only just registered), be a subdomain, or be otherwise invalid. For more details, refer to Cannot add domain.

Onboard a domain
After you onboard your domain, Cloudflare will act as the reverse proxy and DNS provider for your site.
This guide applies to existing domains that were purchased from another provider, and will use a full DNS setup, which is the most common configuration. To set this up, you will have to complete a few steps at Cloudflare, but also update some settings at your domain registrar[^1], and at your previous DNS provider (if you were using one).
:::tip[Cloudflare Registrar]
If you need a new domain, you can buy one from Cloudflare without markup fees. We will complete the rest of this setup for you.
:::
1. Add your domain
Log in to the Cloudflare dashboard.
https://dash.cloudflare.com/?to=/:account/domains/overview
Select Onboard a domain.
Enter your website's apex domain (for example, 
example.com), choose how you would like to add your DNS records, and select Continue.
:::note
If Cloudflare is unable to identify your domain as a registered domain, make sure you are using an existing top-level domain (
.com, 
.net, 
.biz, or others).
Cloudflare requires your apex domain to be one level below a valid TLD defined in the Public Suffix List (PSL). For instance, 
example.com is valid but 
level2.example.com[^2] or 
example.home are not.
:::
Select a plan.
2. Review DNS records
Your DNS records must be accurate for your domain to work properly. If you don't know what DNS records are, consider the video below for a quick explanation.
If you find any missing records, manually add those records.
Depending on your site setup, you may want to adjust the proxy status for certain 
A, 
AAAA, or 
CNAME records. Each record has a proxy status toggle:
Proxied (orange cloud): web traffic goes through the Cloudflare network, which provides caching, DDoS protection, and other security features.
DNS only (gray cloud): Cloudflare returns the DNS record value but does not proxy traffic. Use this for CNAME records that verify your domain for third-party services.
Select Continue.
3. Update nameservers
Usually, you need to add these nameservers at your registrar. Refer to Update nameservers for more information.
Provider-specific instructions
:::caution[DNSSEC]
If your domain uses DNSSEC, you must turn it off at your registrar before changing nameservers. Changing nameservers while DNSSEC is active can cause your domain to become unreachable. You can re-enable DNSSEC through Cloudflare after your domain is active.
:::
4. Complete SSL/TLS setup
To prevent insecure connections and visitor browser errors, review your SSL/TLS certificates. Many Cloudflare services will automatically protect and speed up your web traffic after your nameservers are updated and your DNS records are proxied. For further guidance, refer to Proxy status.
If you encounter unexpected results when changing your nameservers, refer to the DNS Full Setup troubleshooting.
Further options
Other DNS setups
To use Cloudflare as a reverse proxy but maintain your DNS provider, refer to partial setup.
To use one or more DNS providers, refer to DNS Zone transfers.
Enterprise customers can onboard lower-level subdomains using Subdomain setup.
Minimize downtime
[^1]: The provider you purchased your domain from
[^2]: Enterprise customers can onboard these using Subdomain setup.
[^3]: A security feature that protects DNS records from spoofing

Change your domain version
Version Management is available for Enterprise customers and allows you to safely test, deploy, and roll back changes to your zone configurations.
Enable versioning
(Optional) Create additional environments
These environments each serve a specific purpose and are accessed differently:
 
For more details, refer to Create environment.
Update configurations
Test version
Promote version
Next, promote your version through your different environments.
After promoting to each environment, test the new version in your new environment.
Repeat
For new changes to your zone, create a new version and repeat this process.

Domains
A domain or domain name (also known as a zone) is the location of a website or application, or what an end user types into their browser to get to your website (
example.com).
Get a domain name
You can purchase domain names for your website from a variety of places. Cloudflare offers an at-cost registrar service to purchase new domain names or transfer existing domain names.
Refer to Account and domain management best practices for a detailed list of ways to protect your account and domain.
Host your domain
A web host keeps your website online so visitors can reach it via the domain name.
Cloudflare does not offer web hosting for most websites, though you can deploy and host JAMstack sites with Cloudflare Pages.
Add a domain to Cloudflare
For help onboarding a domain to Cloudflare's CDN, refer to our setup guide.
You will need to update your domain's nameservers and proxy your web traffic to benefit from caching, DDoS protection, Argo Smart Routing, and other application security and performance products.
Get free SSL certificates
Cloudflare offers free, unshared, publicly trusted Universal SSL certificates to all Cloudflare domains.
Manage subdomains
For more details about subdomains (
www.example.com or 
blog.example.com), refer to Manage subdomains.

Manage subdomains
Once you have added your domain to Cloudflare and updated your nameservers, you also might want to set up a subdomain.
Most subdomains serve a specific purpose within the overall context of your website. For example, 
blog.example.com might be your blog, 
support.example.com could be your customer help portal, and 
store.example.com would be your e-commerce site.
Create a subdomain
If you have already added a subdomain at your host, create a corresponding DNS A or CNAME record for that subdomain (
blog, 
store).
Set up redirects
Redirect a subdomain to the apex domain
Sometimes, you might want all traffic to a subdomain (
www.example.com)  to actually go to your apex domain (
example.com).
Create a proxied DNS A record for your subdomain. This record can point to any IP address since all traffic will be redirected prior to reaching the address.
Type
Name
IPv4 address
Proxy status
A
www
192.0.2.1
Proxied
Create a Single Redirect to forward traffic from your subdomain to your apex domain.
When incoming requests match
Using the Expression Editor:
(http.request.full_uri contains "www.example.com")
Then
Type: Dynamic
Expression: 
concat("https://","example.com",http.request.uri.path)
Status code: 301
Redirect the apex domain to a subdomain
Sometimes, you might want all traffic to your apex domain (
example.com) to actually go to a subdomain (
www.example.com).
If you have already added that subdomain at your host, create a corresponding DNS A or CNAME record for that subdomain.
Create a proxied DNS A record for your apex domain. This record can point to any IP address since all traffic will be redirected prior to reaching the address.
Type
Name
IPv4 address
Proxy status
A
@
192.0.2.1
Proxied
Create a Single Redirect to forward traffic from your apex domain to your subdomain.
When incoming requests match
Using the Expression Editor:
(lower(http.host) eq "example.com")
Then
Type: Dynamic
Expression: 
concat("https://","www.example.com",http.request.uri.path)
Status code: 301
SSL/TLS for subdomains
Customize subdomain behavior

Move a domain between Cloudflare accounts
You will have to move or transfer domains from one Cloudflare account to another if you:
Manage a multi-user organization and need to segment domain access by user.
Receive a 
Cloudflare is already hosting under a different account error.
Lose access to your email address or Cloudflare account (though you can also use the backup codes if you have two-factor authentication enabled).
Registered a Cloudflare account with a typo in your email.
:::caution
If your domain is registered with Cloudflare Registrar, you need to submit a manual request to transfer the domain and its registration to a new account.
Refer to Transfer a Cloudflare Registrar domain registration between accounts to complete this process.
:::
Requirements
To transfer a domain from one Cloudflare account to another, you will need:
Access to your domain registrar. If your domain is using Cloudflare Registrar, refer to Transfer a Cloudflare Registrar domain registration between accounts.
At least one Cloudflare account associated with the domain.
Transfer your domain
:::caution
Before transferring an active Cloudflare domain to another Cloudflare account, you must remove any DNSSEC configurations and add-ons or subscriptions.
We also recommend exporting the DNS records of your zone while it is in the previous account. Then, you can import the correct DNS records into the new account.
If you miss this step, Cloudflare will import your proxied DNS records, which might cause your domain to experience a 1000 error.
:::
If you still have access to your previous Cloudflare account, you can copy over the Cloudflare account settings manually. You must reissue SSL/TLS certificates and recreate and validate DNS records when transferring domains between Cloudflare accounts.
If you lose access to the email address associated with your Cloudflare account and do not have backup codes, you will need to manually transfer your domain to a new Cloudflare account associated with a different email address.
The domain transfer process depends on your DNS settings. If Cloudflare is your authoritative DNS provider (that is, your domain nameservers point to Cloudflare), you must:
Create a new Cloudflare account or log in to an existing Cloudflare account.
Add the domain to the account (as if you were adding it for the first time).
Log in to your domain registrar account and update the nameservers to the provided Cloudflare nameservers.
Finalize the nameserver update by selecting your domain in the dashboard > Overview > Re-check now.
Once the Cloudflare network recognizes the nameserver change, the domain in the new account will be marked as Active. While the domain in the new account is Pending, it cannot proxy traffic through Cloudflare and the origin IP addresses will be returned until the domain is marked as Active.
In the old account, the domain will be marked as Moved Away. After seven days in Moved Away status, the domain will be marked as Deleted. After seven days in the Deleted status, the domain will be permanently removed.
For more information, refer to Zone status.
Issue new certificates
SSL/TLS certificates associated with your previous Cloudflare account will not be transferred to your new account. If your site requires an SSL/TLS certificate prior to domain transfer, refer to Minimize downtime.
If you were using custom certificates, you will need to delete them from the previous zone and upload them to the new zone. You can upload the certificates while the new zone is in Pending status - if you do so, once you upload the certificates, they will have a Holding Deployment status and will become active once the zone is active.
You can order an advanced certificate prior to transferring your domain. ACM certificates will automatically deploy to active domains.

Pause Cloudflare
To troubleshoot your site, you can pause Cloudflare globally. This will send traffic directly to your origin web server instead of Cloudflare's reverse proxy. Paused domains also cannot use Cloudflare services like Rules, WAF, and SSL/TLS certificates. Consider turning on Development Mode to bypass caching while preserving protection.
In the Cloudflare dashboard, go to the Account home page and select your account and domain.
https://dash.cloudflare.com/?to=/:account/home
Within Overview, choose Advanced Actions > Pause Cloudflare on Site.
The process of pausing Cloudflare takes five minutes or less. This approach is preferable to changing nameservers, which can cause propagation delays of several hours.
:::note
Disabling a zone does not impact Spectrum applications.
:::
Alternatives to global pause
Disable proxy on DNS records
Instead of pausing Cloudflare globally, you can disable the proxy on individual records:
Log in to the Cloudflare dashboard and select your account and domain.
Go to DNS > Records. Choose the record and select Edit.
Toggle Proxy Status to Off.
Adjusting the proxy status will prevent that record from using Cloudflare services like Rules, WAF, and SSL/TLS certificates.
Enable Development Mode
To troubleshoot caching issues, you could enable Development Mode. This will bypass Cloudflare's cache while still preserving Cloudflare services like Rules, WAF, and SSL/TLS certificates.

Redirect one domain to another
If you have an alias domain that only forwards traffic to another domain (that is, the domain does not have an associated origin server of its own), you can set up redirects directly within Cloudflare.
Add your alias domain (for example, 
previous.com) to Cloudflare.
Make sure that your alias domain has a proxied DNS A or CNAME record that properly resolves DNS queries. You may also want to include a subdomain DNS record for 
www.
Use the IP address 
192.0.2.1 for the 
A record. This address does not route traffic to an origin server but allows Cloudflare to apply rules, redirects, and Workers to incoming traffic. The equivalent IP address for an 
AAAA record is 
100::.
Type
Name
IPv4 address
Proxy status
A
@
192.0.2.1
Proxied
A
www
192.0.2.1
Proxied
Use Redirect rules to forward traffic from your alias domain to your other domain.
This example will redirect all requests for 
smallshop.example.com to a different hostname using HTTPS, keeping the original path and query string.
When incoming requests match
Field: Hostname
Operator: equals
Value: 
smallshop.example.com
If you are using the Expression Editor, enter the following expression:
(http.host eq "smallshop.example.com")
Then
Type: Dynamic
Expression: 
concat("https://globalstore.example.net", http.request.uri.path)
Status code: 301
Preserve query string: Enabled
For example, the redirect rule would perform the following redirects:
Request URL
Target URL
Status code
http://smallshop.example.com/
https://globalstore.example.net/
301
http://smallshop.example.com/admin/?logged_out=true
https://globalstore.example.net/admin/?logged_out=true
301
https://smallshop.example.com/?all_items=1
https://globalstore.example.net/?all_items=1
301
http://example.com/about/
(unchanged)
n/a

Remove a domain
Consider the following sections on how you can remove domains from Cloudflare. Removing your domain cancels all active subscriptions on that domain, which will not be refunded per our billing policy. If you add this domain back to Cloudflare later, you will need to re-purchase all subscriptions. Removing your domain from Cloudflare does not change your domain registration.
Before removing your domain
If you experience website issues, we recommend temporarily pausing Cloudflare to evaluate your website's performance.
If you have an Enterprise plan, you need to change the zone plan to Free.
If you need to re-add the domain in a different account, make sure the current settings have been saved. For example, you may Import and export DNS records.
:::note
If you have just added a domain and have not configured its plan yet, the domain is in the 
Initializing (Finish setup) status and cannot be deleted.
At this step you'll need to select a plan for this domain: the status will then change to 
Pending and you can then delete the domain.
Please also note that domains in the 
Initializing (Finish setup) or 
Pending statuses will automatically be deleted after 28 days if they do not activate.
:::
Actions outside of Cloudflare
When you remove a domain from Cloudflare, it also prevents your domain from using Cloudflare for DNS resolution. To avoid DNS errors, update your nameservers at your domain registrar to use nameservers not owned by Cloudflare.
Refer to Check if your nameservers are pointing to Cloudflare to confirm that your nameservers no longer point to Cloudflare.
At your registrar, make sure you do not have a DS DNS record. This record enables DNSSEC and could prevent your DNS records from being changed.
Actions within Cloudflare
Cancel active add-on subscriptions.
Delete all the Logpush jobs for that domain
If you use Cloudflare Registrar:
Disable domain auto-renewal or transfer your domain out of Cloudflare.
If the domain has already expired, it will be automatically removed from your account. Refer to What happens when a domain expires?
If the domain has not yet expired you can likely request deletion. Refer to Delete a domain registration
If enabled, disable DNSSEC. In your domain dashboard, go to DNS > Settings. Within DNSSEC, select Disable DNSSEC. Select Confirm.
Remove a domain activated in Cloudflare
Log in to the Cloudflare dashboard and select your domain.
https://dash.cloudflare.com/?to=/:account/:zone/
On the domain Overview page, find Advanced Actions and then select Remove from Cloudflare.
:::note
If you are using an Enterprise domain, change your domain plan to Free, which will give you access to Remove from Cloudflare.
If this does not work, contact your account team.
:::
Select Confirm.

Star domains
For quick access to commonly configured domains (also known as "zones"), star up to ten domains per account in the Cloudflare dashboard.
Star a domain
To star a domain:
Log into the Cloudflare dashboard.
Select your account and domain.
On the website Overview, select Star.
Filter to starred domains
To view only starred domains in your account:
Log into the Cloudflare dashboard.
Select your account.
On the account Home, select Starred.

Set up dashboard SSO
Cloudflare offers single sign-on (SSO) for all customers who log in with a custom email domain. By creating a Cloudflare SSO connector, you can enforce SSO to the Cloudflare dashboard with the identity provider (IdP) of your choice. SSO will be enforced for every user in your email domain.
Availability
Cloudflare Dashboard SSO is available for free to all plans.
Free
Pro
Business
Enterprise
Availability
Yes
Yes
Yes
Yes
Prerequisites
You must control your email domain and be able to add a TXT record to verify this.
Public email providers such as 
@gmail.com are not allowed.
Every user with that email domain must be an employee in your organization. For example, university domains such as 
@harvard.edu are not allowed because they include student emails.
You must be a super administrator and be able to access the Cloudflare API.
A Cloudflare Zero Trust organization with any subscription tier (including Free) must be created. To set up a Cloudflare Zero Trust organization, refer to Create a Cloudflare Zero Trust organization.
1. Set up an IdP
Add an IdP to Cloudflare Zero Trust by following our detailed instructions.
Once you configure your IdP, make sure you also test your IdP.
2. Register your domain with Cloudflare for SSO
:::caution
You must create an Account API token with the role 
SSO Connector Edit and store it securely. This acts as a backup plan, allowing you to disable SSO via the API if you are accidentally locked out, such as due to changes in your IdP configuration later.
:::
Dashboard
Once you have configured an IdP in Cloudflare One, go to the Members page to manage SSO connectors.
https://dash.cloudflare.com/?to=/:account/members
If step 1 was successful, a button to add a new SSO domain will be present. Select the button to begin the process of adding a new SSO domain.
Enter your email domain and select Create to move to the verification step.
:::note
Some top level domains, such as 
.edu, are prohibited from being used as SSO domains.
:::
API
Using a command line terminal where you have already set the environment variable 
CLOUDFLARE_API_TOKEN to a user or account API token which has the 
SSO Connector Edit permission, run the following command to create an SSO connector. Replace 
{account_id} with your account ID, and 
{domain} with your email domain.
curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/sso_connectors" \
  --request POST \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{"email_domain":"{domain}"}'
{
	"success": true,
	"errors": [],
	"messages": [],
	"result": {
		"id": "c3ebcba5c20b42f73e111110d0be67d",
		"enabled": false,
		"email_domain": "cool.cats",
		"verification": {
			"code": "cloudflare_dashboard_sso=111111111",
			"status": "pending"
		},
		"created_on": "2025-09-05T20:35:34Z"
	}
}
3. Verify domain ownership
Dashboard
If you are unable to change your DNS records right away, the option to verify later is available. The verification process can be manually triggered from the actions menu for that connector in the list.
Copy the verification code and create a TXT record in your DNS configuration with that value. The record must include all of the text including the 
cloudflare_dashboard_sso= prefix.
Cloudflare will automatically poll this DNS record until it is found or a timeout is reached within two days.
If the verification process fails due to timeout, you can manually reinitiate the polling by selecting Begin verification in the actions menu for that connector in the list.
API
Copy the verification code (for example 
cloudflare_dashboard_sso=1111111) and create a 
TXT record in your DNS configuration with that value. To test that the DNS record was correctly configured, you can use the 
dig command to query your email domain:
dig cool.cats TXT +short
"cloudflare_dashboard_sso=111111111"
The 
TXT record must include the 
cloudflare_dashboard_sso= prefix along with the numerical code.
Cloudflare will automatically poll this DNS record until it is found or a timeout is reached within two days. If verification fails due to timeout, you may manually reinitiate the polling by running the following command:
curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/sso_connectors/{sso_connector_id}/begin_verification" \
  --request POST \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
Once the verification process has completed or timed out, you will receive an email notification with the verification result.
4. Enable dashboard SSO
:::caution
Enabling Cloudflare Dashboard SSO for an email domain (for example, 
@mycompany.com) will apply globally to all users with that domain, regardless of which accounts those users have access to. All users will be required to authenticate via the specified identity provider, including users registered on Cloudflare prior to the domain being configured for SSO.
:::
Once the verification process has completed and successfully verified domain ownership, you may enable the connector.
Domains that are associated with an already enabled connector belonging to a different account may not be enabled on a new account until disabled on the old account.
Dashboard
Enable the connector by selecting Enable in the Actions menu for that connector in the list.
API
Enable the connector by running the following — again, replacing the 
{account_id} value with your account ID, and additionally replacing the 
{sso_connector_id} with the value you obtained from the 
id field in the response to the previous call.
curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/sso_connectors/{sso_connector_id}" \
  --request PATCH \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{"enabled": true}'
Test your IdP before enforcement
Before enabling SSO for your domain, verify that your identity provider is configured correctly:
In the Cloudflare dashboard, go to Zero Trust > Integrations > Identity providers.
Find your IdP and select Test.
Confirm that the test returns a successful authentication result.
If the test fails, review your IdP configuration against the identity provider setup instructions before enabling the SSO connector.
Troubleshoot IdP errors
If you encounter errors during IdP setup or testing, provide the following when contacting support:
The error message returned by the IdP test.
A sanitized HAR file captured while running the IdP test from the dashboard.
Limitations
Cloudflare dashboard SSO does not support:
Users with plus-addressed emails, such as 
example+2@domain.com. If you have users like this added to your Cloudflare organization, they will be unable to login with SSO.
Adding a separate email-based policy to the Zero Trust SSO application that does not match your SSO domain policy.
Multiple Zero Trust domain policies. If another domain policy is required, you can create another SSO connector. This will create a second policy for that new domain in your SSO application.
Deleting the auto-generated Zero Trust 
allow email domain policy. If this policy is deleted, your organization's administrators cannot access the Cloudflare dashboard.
IdP-initiated SSO
IdP-initiated login is supported for Cloudflare dashboard SSO, with configuration available via your identity provider (IdP).
Step-by-step guides are currently available for Okta and Entra ID, and similar configurations are possible with other identity providers that support custom SSO endpoints.
Okta
Configure an identity provider (IdP)-initiated single sign-on (SSO) session using Cloudflare Zero Trust and Okta.
Prerequisites
In the Cloudflare dashboard, go to Zero Trust > Access controls > Applications > select your SSO App.
Select Configure to access the application settings.
In the Basic Information section, copy the SSO Endpoint URL and Access Entity ID or Issuer. You will need these values for your IdP setup.
Configure Okta as the IdP
Log in to your Okta Admin Dashboard and go to Applications > Applications.
Select Create App Integration to start a new SAML integration to handle the IdP-initiated SSO flow. Note that this is a second, distinct Cloudflare-Okta integration, created separately from the IdP integration with Zero Trust.
In the pop-up, select SAML 2.0 and select Next.
Enter a name for the app and select Next.
In the Single Sign-On URL field, paste the SSO Endpoint URL you copied in Prerequisites.
In the Audience URI (SP Entity ID) field, paste the Access Entity ID or Issuer you copied in Prerequisites.
Set the Name ID Format to EmailAddress.
Set the Application Username to Email.
Select Next > Finish to save the integration.
Test the integration by going to your Okta User Dashboard, locating the new app tile, and selecting it to verify the SSO flow.
(Optional) Enforce single IdP login with instant authentication
If you use only one IdP (for example, Okta) for Cloudflare SSO and want users to skip the identity provider selection prompt:
In the Cloudflare dashboard, go to Zero Trust > Access controls > Applications > select your SSO App.
Go to Authentication.
Turn off Accept all available identity providers and ensure only Okta is selected as the login method.
Turn on Apply instant authentication to allow users to skip identity provider selection.
Entra ID
Configure an identity provider (IdP)-initiated single sign-on (SSO) session using Cloudflare Zero Trust and Microsoft Entra ID (formerly Azure AD).
Prerequisites
In the Cloudflare dashboard, go to Zero Trust > Access controls > Applications > select your SSO App.
Select Configure to access the application settings.
In the Basic Information section, copy the SSO Endpoint URL and Access Entity ID or Issuer. You will need these values when configuring Entra ID.
Configure Entra ID as the IdP
Log in to the Microsoft Entra admin center and go to Applications > Enterprise applications.
Select New application > Create your own application.
Enter a name for the application (for example, 
Cloudflare Dashboard SSO), select Integrate any other application you don't find in the gallery (Non-gallery), then select Create.
Once the application is created, go to Single sign-on in the left-hand menu and select SAML.
In the Basic SAML Configuration section, select Edit and configure the following:
Identifier (Entity ID): Paste the Access Entity ID or Issuer you copied in Prerequisites.
Reply URL (Assertion Consumer Service URL): Paste the SSO Endpoint URL you copied in Prerequisites.
Select Save.
In the Attributes & Claims section, ensure the Unique User Identifier (Name ID) claim is set to emit the user's email address (for example, 
user.mail or 
user.userprincipalname).
Assign users or groups to the application under Users and groups to control who can use IdP-initiated SSO.
Test the integration by going to Single sign-on > Test and selecting Test sign in to verify the SSO flow.
(Optional) Enforce single IdP login with instant authentication
If you use only one IdP (for example, Entra ID) for Cloudflare SSO and want users to skip the identity provider selection prompt:
In the Cloudflare dashboard, go to Zero Trust > Access controls > Applications > select your SSO App.
Go to Authentication.
Turn off Accept all available identity providers and ensure only Entra ID is selected as the login method.
Turn on Apply instant authentication to allow users to skip identity provider selection.
Bypass dashboard SSO
This section describes how to restore access to the Cloudflare dashboard in case you are unable to login with SSO.
Option 1: Add a backup IdP
If there is an issue with your SSO IdP provider, you can add an alternate IdP using the API. The following example shows how to add Cloudflare One-time PIN as a login method:
Add one-time PIN login:
POST /accounts/{account_id}/access/identity_providers
Get the 
id of the 
dash_sso Access application. You can use 
jq to quickly find the correct application:
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/access/apps" \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  | jq '.result[] | select(.type == "dash_sso")'
   {
   	"id": "3537a672-e4d8-4d89-aab9-26cb622918a1",
   	"uid": "3537a672-e4d8-4d89-aab9-26cb622918a1",
   	"type": "dash_sso",
   	"name": "SSO App"
   	// ...
   }
Using the 
id obtained above, update SSO App to accept all identity providers. To avoid overwriting your existing configuration, the PUT request body should contain all fields returned by the previous GET request.
PUT /accounts/{account_id}/access/apps/{app_id}
Users will now have the option to log in using a one-time PIN.
Option 2: Disable dashboard SSO
:::caution
Before disabling SSO, make sure you have access to your Cloudflare user email. This will allow you to reset your password in case you get logged out of the Cloudflare dashboard.
:::
Dashboard
Navigate to the Members page.
https://dash.cloudflare.com/?to=/:account/members
Go to Settings.
Select the actions menu for the SSO connector in the list and select Disable.
Type the domain of the connector and click confirm to complete the disable action.
API
The following API calls will disable SSO enforcement for an account. This action can only be performed by API tokens with the 
SSO connectors edit role or Super Administrators.
Get your SSO connector 
id:
curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/sso_connectors" \
  --request GET \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
   {
   	"result": [
   		{
   			"id": "d616ac82cc7f87153112d75a711c5c3c",
   			"email_domain": "cool.cats",
   			"enabled": true
   			// ...
   		}
   	],
   	"success": true,
   	"errors": [],
   	"messages": []
   }
Disable the SSO connector:
curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/sso_connectors/{connector_id}" \
  --request PATCH \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "enabled": false
  }'
   {
   	"result": [
   		{
   			"id": "d616ac82cc7f87153112d75a711c5c3c",
   			"email_domain": "cool.cats",
   			"enabled": false
   			// ...
   		}
   	],
   	"success": true,
   	"errors": [],
   	"messages": []
   }
Users can now log in using their Cloudflare account email and password. If a user does not have a password, they can use the forgot password method on the login page to create one.
Change your Zero Trust team name
Cloudflare does not allow you to change your team name while a SSO connector is created. To change your team name, you must disable and delete your SSO connector(s).
Dashboard
Navigate to the Members page.
https://dash.cloudflare.com/?to=/:account/members
Go to Settings.
Disable all SSO connectors.
Delete all SSO connectors.
API
Get all SSO connectors for your account.
curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/sso_connectors" \
  --request GET \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
Disable any active SSO connectors using the 
id of each connector from the previous step.
curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/sso_connectors/{connector_id}" \
  --request PATCH \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "enabled": false
  }'
Delete all SSO connectors using the 
id of each connector from the previous step.
curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/sso_connectors/{connector_id}" \
  --request DELETE \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
In the Cloudflare dashboard, go to Zero Trust > Reusable components > Custom pages.
Under Team domain, select Edit to enter the new team name. Select Save.
In your identity provider, update your Cloudflare integration with the new team name. For example, if you are using a SAML IdP, you will need to update the Single Sign-on URL and Entity ID to 
https://<new-team-name>.cloudflareaccess.com/cdn-cgi/access/callback.
Recreate any deleted SSO connectors using the steps in Register your domain with Cloudflare for SSO.
Follow the verification and enable steps after recreating the SSO connectors.

Members and permissions
On any Cloudflare account, you can collaborate by adding members to your account and assigning them access via one or several policies.
Configuring permissions for each member helps prevent accidental changes to your account. For example, you can scope a team member to only manage staging domains, so they do not accidentally modify a production site. Use policies to grant each member the minimum level of access they need.
Every policy has three parts:
The actor
The role
The scope
Refer to the resources below to configure policies to ensure that you can assign only the necessary access permissions to your account members.
Resources

Manage
Granting access to others on your account is done with several sets of data principles:
Accounts have Account Members.
Account Members have policies.
Policies are constructed out of actors, roles, and scopes.
When inviting a new member, you can assign one or more permission policies to them directly. Policies can also be added or revoked at a later time.
Learn how to add new account members, edit or revoke their access, and resend verification emails.
:::note
:::
View account members
Add account members
Edit member permissions
Manage member settings
Resend an invitation
Remove account members
:::note
If you have been invited to an account and want to remove yourself from the account, go to the Members page. On your own row, select ... > Leave account.
:::
Super Administrator access
If you are a Super Administrator for an account that has existing domains and you decide to leave the account, you can invite a new Super Administrator who will have access to the same account privileges.
You can delete your user as a Super Administrator, but you cannot delete your account. Other Super Administrators will continue to have access to the appropriate privileges to manage the account, including billing information.

Policies
Policies define what access a given user has to your account or domains, and are constructed out of three parts:
An actor (your user).
A 
ResourceGroup (a scope).
A 
PermissionGroup (roles).
An account member can have one or several of these policies to represent the most appropriate access. A member’s effective permissions are the union of all policies assigned to them—whether directly, or through group membership.
To increase the usability and flexibility of Cloudflare's role system, changes to the API have been made to expose these underlying data principles and allow users to interact with them.
For example, you may want to assign multiple policies and use scopes to control access to an account where you have a single account with both Production and Staging domains, and a user that should be able see the whole account, purge the production domains, but have the ability to configure the staging domains.
Manage policies
A set of standard API endpoints is present on every account that allow access to your members, which has recently been enhanced by a list of 
resourceGroups and 
PermissionGroups.
A 
resourceGroup is a unique identifier for the scope for which a policy applies.
A 
permissionGroup is a unique identifier for the set of roles that are assigned to a given policy.
Refer to the API documentation for more information.
Viewing Effective Permissions
Cloudflare supports assigning permissions to members both directly and through User Groups. A member’s effective permissions are additive; they represent the union of all permissions granted directly to a member and those inherited through a member's group membership.
:::note
To understand a member’s full access, check both the Members and User Groups views:
The Members view shows only the permissions explicitly assigned to the user.
Permissions inherited through User Groups are not shown on the Members page. To see these, go to the Groups tab, find the groups the user belongs to, and review the policies assigned to each group.
Cloudflare is actively working on improvements to consolidate this view in a future update.
:::

Roles
Whenever you add a new member to your account, you can assign policies to those users and make use of the available roles. Roles can only ever be assigned to their given scope and multiple roles can be assigned to a given policy.
Account-scoped roles
Account-scoped roles apply across an entire Cloudflare account, and through all domains in that account.
Role
Description
Administrator
Can access the full account and edit subscriptions. Cannot manage members nor billing profile.
Super Administrator - All Privileges
Can edit any Cloudflare setting, make purchases, update billing, manage members, create account-owned API tokens, and manage all account-owned API tokens. Super Administrators can revoke the access of other Super Administrators.
Administrator Read Only
Can access the full account in read-only mode.
Analytics
Can read Analytics.
API Gateway
Grants full access to API Gateway (including API Shield) for all domains in an account.
API Gateway Read
Grants read access to API Gateway (including API Shield) for all domains in an account.
API Token Provisioning
Can create account API tokens.
Application Security Reports Read
Can read Application Security Reports.
Audit Logs Viewer
Can view Audit Logs.
Bot Management (Account-Wide)
Can edit Bot Management (including Super Bot Fight Mode) configurations for all domains in account.
Billing
Can edit the account's billing profile and subscriptions
Cache Purge
Can purge the edge cache and allows the reading of zone settings.
Cloudflare Access
Can edit Cloudflare Access and Cloudflare Tunnel.
Cloudflare CASB
Can edit Cloudflare CASB.
Cloudflare CASB Read
Can read Cloudflare CASB.
Cloudchamber Admin
Can manage Cloudchamber deployments.
Cloudchamber Admin Read Only
Can manage Cloudchamber deployments in read-only mode.
Cloudflare DEX
Can edit Cloudflare DEX.
Cloudflare Gateway
Can edit Cloudflare Gateway and read Access.
Cloudflare Images
Can access Cloudflare Images data.
Cloudflare R2 Admin
Can edit Cloudflare R2 buckets, objects, and associated configurations.
Cloudflare R2 Read
Can read Cloudflare R2 buckets, objects, and associated configurations.
Cloudflare Stream
Can edit Cloudflare Stream media.
Cloudflare Zero Trust
Can edit Cloudflare Zero Trust. Grants administrator access to all Zero Trust products including Access, Gateway, the Cloudflare One Client, Tunnel, Browser Isolation, CASB, DLP, DEX, and Email security.
Cloudflare Zero Trust Secure DNS Locations Write
Can view Gateway DNS locations and create and edit secure DNS locations.
Cloudflare Zero Trust PII
Can access Cloudflare Zero Trust PII.
Cloudflare Zero Trust Read Only
Can access Cloudflare Zero Trust read only mode.
Cloudflare Zero Trust Reporting
Can access Cloudflare Zero Trust reporting data.
Zero Trust Account Lists Admin
Can create, edit, and delete all Gateway and Access lists in an account.
Zero Trust Account Lists Read
Can view all Gateway and Access lists in an account.
Zero Trust DNS Location Admin
Can create, edit, and delete all Gateway DNS locations in an account.
Zero Trust DNS Policies Admin
Can create, edit, delete, and reorder all Gateway DNS policies in an account.
Zero Trust Egress Policies Admin
Can create, edit, delete, and reorder all Gateway egress policies in an account.
Zero Trust Gateway Firewall Policies Admin
Can create, edit, delete, and reorder all Gateway firewall policies in an account, including DNS, HTTP, and network policies.
Zero Trust Gateway Policies Admin
Can create, edit, delete, and reorder all Gateway traffic policies in an account.
Zero Trust Gateway Policies Read
Can view all Gateway traffic policies in an account.
Zero Trust Gateway Read Only
Can view all Gateway resources in an account in read-only mode, including traffic policies, lists, and DNS locations.
Zero Trust HTTP Policies Admin
Can create, edit, delete, and reorder all Gateway HTTP policies in an account, including isolation policies.
Zero Trust Network Policies Admin
Can create, edit, delete, and reorder all Gateway network policies in an account.
Zero Trust Proxy Endpoints Admin
Can create, edit, and delete all Gateway proxy endpoints in an account.
Zero Trust Resolver Policies Admin
Can create, edit, delete, and reorder all Gateway resolver policies in an account.
Connectivity Directory Admin
Can view, edit, create, and delete Workers VPC Services and bind to Cloudflare Tunnel.
Connectivity Directory Bind
Can read, list, and bind to Workers VPC Services, as well as read and list Cloudflare Tunnels.
Connectivity Directory Read
Can view Workers VPC Services and Cloudflare Tunnels.
DNS
Can edit DNS records.
Email Configuration Admin
Grants administrator access to Email security. Cannot take actions on emails, or read emails.
Email Integration Admin
Grants read and write access to integrations only.
Email Security Analyst
Grants analyst access. Can take action on emails and read emails.
Email Security Read only
Grants read only access to all of Email security.
Email Security Reporting
Grants read access to Email security metrics.
Email Security Policy Admin
Grants read access to all settings, and write access to allow policies, trusted domains, and blocked senders
Firewall
Can edit WAF, IP Access rules, Zone Lockdown settings, Cache Rules, and Cache Response Rules.
HTTP Applications
Grants full access to HTTP Applications.
HTTP Applications Read
Grants read-only access to HTTP Applications.
Load Balancer
Can edit Load Balancers, Pools, Origins, and Health Checks.
Load Balancing Account Read
Can read Load Balancing resources such as Load Balancers, Monitors, Monitor Groups, Pools, and Health Checks.
Log Share
Can edit Log Share configuration.
Log Share Reader
Can read Enterprise Log Share.
Magic Network Monitoring
Can view and edit Network Flow configuration.
Magic Network Monitoring Admin
Can view, edit, create, and delete Network Flow configuration.
Magic Network Monitoring Read-Only
Can view Network Flow configuration.
Network Services Write (Magic)
Grants write access to network configurations for Magic services. Magic Tunnel health checks require the Analytics role for non-admin users.
Network Services Read (Magic)
Grants read access to network configurations for Magic services. Magic Tunnel health checks require the Analytics role for non-admin users.
Minimal Account Access
Can view account, and nothing else.
Page Shield
Grants write access to client-side security (formerly Page Shield) across the whole account.
Page Shield Read
Grants read access to client-side security (formerly Page Shield) across the whole account.
Realtime
Grants access to Realtime configuration excluding sensitive data.
Realtime Admin
Grants administrator access to Realtime configuration.
Hyperdrive Read only
Grants read access to Hyperdrive database configuration.
Hyperdrive Admin
Grants write access to Hyperdrive database configuration.
SSL/TLS, Caching, Performance, Page Rules, and Customization
Can edit most Cloudflare settings except for DNS and Firewall.
Secrets Store Admin
Can create, edit, duplicate, delete, and view secrets metadata. Can also add a Secrets Store binding to a Worker.
Secrets Store Deployer
Can view secrets metadata but cannot create, edit, duplicate, nor delete secrets. Can also add a Secrets Store binding to a Worker.
Secrets Store Reporter
Can view secrets metadata. Cannot perform any actions (create, edit, duplicate, delete secrets), nor add a Secrets Store binding to a Worker.
Brand Protection
Can access the Brand Protection feature on the API and Cloudflare dashboard. Brand Protection role also gives you access to the Investigate platform.
Cloudforce One Admin
Grants write access to Cloudforce One.
Cloudforce One Read
Grants read access to Cloudforce One, and cannot create and/or edit RFIs or PIRs.
Trust and Safety
Can access trust and safety related services.
Turnstile
Grants full access to Turnstile.
Turnstile Read
Grants read access to Turnstile.
Vectorize Admin
Can edit Vectorize configurations.
Vectorize Read only
Can read Vectorize configurations.
Waiting Room Admin
Can edit Waiting Room configuration.
Waiting Room Read
Can read Waiting Room configuration.
Workers Editor
Can use the Workers Playground.
Workers Platform Admin
Grants edit and read access to all products typically used as part of Cloudflare's Developer Platform, including Workers, Pages, Durable Objects, KV, R2, Zones, Zone Analytics and Page Rules. Cloudflare may add additional read-only permissions to this role as new products are introduced.
Workers Platform (Read-only)
Grants read-only access to all products typically used as part of Cloudflare's Developer Platform, including Workers, Pages, Durable Objects, KV, R2, Zones, Zone Analytics and Page Rules. Cloudflare may add additional read-only permissions to this role as new products are introduced.
Connectivity Directory Read
Can view Workers VPC Services and Cloudflare Tunnels.
Connectivity Directory Bind
Can read, list, and bind to Workers VPC Services, as well as read and list Cloudflare Tunnels.
Connectivity Directory Admin
Can view, edit, create, and delete Workers VPC Services, including the ability to create VPC Services that bind to Cloudflare Tunnel.
Zaraz Admin
Can edit and publish Zaraz configuration.
Zaraz Edit
Can edit Zaraz configuration.
Zaraz Read only
Can read Zaraz configuration.
Zone Versioning (Account-Wide)
Can view and edit Zone Versioning for all domains in account.
Zone Versioning Read (Account-Wide)
Can view Zone Versioning for all domains in account.
Domain-scoped roles
Domain-scoped roles apply for a given domain within an account.
Role
Description
AI Crawl Control Read Only
Can read AI Crawl Control and metrics. This role also grants read access to the underlying products AI Crawl Control depends on (analytics, DNS, firewall, and bot management), which makes additional zone pages visible in the dashboard, including the zone Overview, Analytics, and Security Analytics.
Bot Management
Can edit Bot Management (including Super Bot Fight Mode) configurations.
Cache Domain Purge
Grants access to purge the edge cache for a specific domain and allows the reading of zone settings.
Domain Administrator
Grants full access to domains in an account (including Regional Services configurations), and read-only access to account-wide Firewall, Access, and Worker resources.
Domain Administrator Read Only
Grants read-only access to domains in an account, as well as account-wide Firewall, Access, and Worker resources. This role does not currently include read access to Regional Services configurations.
Domain API Gateway
Grants full access to API Gateway (including API Shield).
Domain API Gateway Read
Grants read access to API Gateway (including API Shield).
Domain DNS
Grants access to edit DNS settings for domains in an account.
Domain Page Shield
Grants write access to client-side security for domains in an account.
Domain Page Shield Read
Grants read access to client-side security for domains in an account.
Domain Waiting Room Admin
Can edit waiting rooms configuration.
Domain Waiting Room Read
Can read waiting rooms configuration.
Zone Versioning
Grants full access to Zone Versioning.
Zone Versioning Read
Grants read-only access to Zone Versioning.
Resource-scoped roles
Resource-scoped roles apply for a specific resource within an account.
:::note
Resource-scoped roles is currently in Beta.
:::
Role
Description
Cloudflare Access App Admin
Can edit a specific Access application in an account.
Cloudflare Access Identity Provider Admin
Can edit a specific Cloudflare One identity provider (IdP) in an account.
Cloudflare Access Policy Admin
Can edit a specific Access policy in an account.
Cloudflare Access Service Token Admin
Can edit a specific Access service token in an account.
Access for Infrastructure Target Admin
Can edit a specific Access for Infrastructure target in an account.
Individual Gateway lists
Scopes permissions to a specific Gateway list. Refer to Granular permissions for Gateway for details.
Individual Gateway policies
Scopes permissions to a specific Gateway traffic policy (DNS, HTTP, network, resolver, or egress). Refer to Granular permissions for Gateway for details.
Individual Cloudflare Tunnel instances
Scopes permissions to a specific Cloudflare Tunnel instance. Refer to Granular permissions for Cloudflare Tunnel for details.
Individual Cloudflare Mesh nodes
Scopes permissions to a specific Cloudflare Mesh node. Refer to Granular permissions for Cloudflare Tunnel and Cloudflare Mesh for details.

Role scopes
Scopes are one of three constituent parts of a policy that allows granting of access to users.
To allow for flexible combinations of access to users, Cloudflare currently has account-level scopes, domain scopes, and resource-specific scopes. Each scope is associated with a different set of roles.
Account scope: Use when the member needs access across the entire account, for example, billing or account-level settings.
Specific domains: Use when the member should only manage certain domains, for example, a developer who works on staging domains but should not modify production.
Domain groups: Use when you have related domains that share the same access needs, for example, all production domains.
Specific resources: Use when access should be limited to individual resources.
Choose the scope of roles
Each policy has a limitation of a single scope, but you can assign multiple policies to a given user.
You can choose the scope of a policy when you add a member.
Account scope
If you want the member to have a policy that applies across your account, use the following combination of fields.
Field
Value
Operator
Include
Type
All domains
:::note
You can only assign account-scoped roles as part of these types of policies
:::
Specific domains
If you want the member to have a policy that applies to a specific domain, use the following combination of fields. When applying these roles to this policy, only domain-scoped roles can be used.
Field
Value
Operator
Include
Type
A specific domain
Name
A specific domain
Domain groups
If you have a set of domains that are all categorized similarly (e.g. all of your sensitive/production domains, all domains around a given project or geography), you can pre-assign them into a domain group and then create policies that provide access to all domains within this group.
Create group
To create a domain group:
In the Cloudflare dashboard, go to the Settings > Lists page. (You must be logged in as a Super Administrator and have a verified email address).
https://dash.cloudflare.com/?to=/:account/configurations
For Domain Group Manager, select Create.
Create your domain group:
Select the domains to include.
Add a Name.
Select Create.
You can also edit and delete these groups as needed.
Use group
To assign a member permissions to a domain group, use the following combination of fields:
Field
Value
Operator
Include
Type
Domain Group
Name
Example Group
:::note
With Domain Groups, you can only assign domain-scoped roles to these members.
:::
Specific resources
If you want the member to have a policy that applies to a specific resource, use the following combination of fields.
Field
Value
Operator
Include
Type
Granular
Product
Product Name
Resource
Specific Resource
Available scopes
You can assign the following resource-specific scopes to members:
Scope
Description
Individual Access applications
Grant access to manage a specific Access application.
Individual Access identity providers (IdPs)
Grant access to manage a specific Cloudflare One identity provider (IdP).
Individual Access policies
Grant access to manage a specific Access policy.
Individual Access service tokens
Grant access to manage a specific Access service token.
Individual Access infrastructure targets
Grant access to manage a specific Access for Infrastructure target.
Individual Cloudflare Tunnel instances
Grant access to manage a specific Cloudflare Tunnel instance.
Individual Cloudflare Mesh nodes
Grant access to manage a specific Cloudflare Mesh node.
:::note
When using scopes for specific resources, you can only assign resource-scoped roles to these members.
:::

User Groups
User Groups are a collection of account members that are treated equally from an access control perspective. User Groups can be assigned permission policies, with individual members in the group receiving all permissions of the roles assigned to the User Group. If users also have individually assigned permissions, then their effective permissions are the union of all of their individual permissions, plus the permissions for all of the User Groups they are a member of.
:::note
User Group permissions are inherited by each member of the group but are not currently reflected in the role field on the Members page. To view a member’s full set of permissions, check both:
The Members page for any directly assigned policies
The Groups tab to identify which groups the member belongs to, and the policies applied to those groups
Cloudflare is actively working on improving this experience to make inherited and direct permissions easier to view.
:::
Create a User Group manually
In the Cloudflare dashboard, go to the Members page.
https://dash.cloudflare.com/?to=/:account/members
Select the Groups tab.
Select Create a Group and enter a name and description for your new group.
Select Create group to confirm your changes. The Group members tab displays.
Select Add members.
Select the relevant members you want to include in the group and select Add to Group.
Assign a Permission Policy
With your Group created, you can now add a Permission Policy to your Group.
Dashboard
In the Groups tab under Permission policies, select Add a Policy.
Specify the scope and permissions you want applied to the members of the group.
Select Create Policy to apply it to the group.
API
Using the role identifiers from the previous section, you can create a permission policy for your group.
export ADMIN_ROLE='...' # id field from admin or desired role entry from permission_groups API response
$ cat <<-PAYLOAD | curl -XPUT  -H "Authorization: Bearer $AOT" -H "Content-type: application/json" --data-binary @- https://api.cloudflare.com/client/v4/accounts/$ACCT/iam/user_groups/$PUSHED_GROUP  | jq .
{
    "policies": [
        {
            "access": "allow",
            "permission_groups": [{"id": "$ADMIN_ROLE"}],
            "resource_groups": [{
                "scope": {
                    "key": "com.cloudflare.api.account.$ACCT",
                    "objects": [{"key":"*"}]
                }
            }]
        }
    ]
}
PAYLOAD
Reset a policy to an empty state
If you made a mistake while creating the group policy or need to reset the policy to an empty state, send another PUT request to the group API with an empty policy array to overwrite with your new policy.
$ cat <<-PAYLOAD | curl -XPUT  -H "Authorization: Bearer $AOT" -H "Content-type: application/json" --data-binary @- https://api.cloudflare.com/client/v4/accounts/$ACCT/iam/user_groups/$PUSHED_GROUP  | jq .
{
    "policies": []
}
PAYLOAD
Create a User Group with SCIM
Customers with the SCIM integration configured can sync User Groups from an upstream identity provider to Cloudflare. Cloudflare's SCIM integration requires one external application per account.
:::note
If you use the Cloudflare dashboard SCIM integration, you can sync Groups from an upstream Identity Provider. This allows you to centralize user and group management at your identity provider.
Note that when managing User Groups via SCIM:
You cannot change the name, members, or delete the group manually from the Cloudflare dashboard or API.
The integration requires one external SCIM application per Cloudflare account.
Cloudflare does not currently support updating user profile fields (
firstName, 
lastName, or 
email) via SCIM. If those attributes change in your IdP, they will not be updated in Cloudflare. These values are only set during initial provisioning.
:::
To set up a user group with SCIM, refer to the Provisioning with SCIM guide.
Set up permissions for User Groups
After a user group is created either manually in Cloudflare dashboard or through SCIM integration the final step is to attach permissions to it.
Dashboard
Go to Manage members > Members > User groups.
Select the user group you want to attach permissions to.
Select the Permission policies tab and select Add policy.
Choose the scope and role that you want to apply to the policy.
Select Save to apply the policy.
API
Before you begin, confirm the groups that were created internally or have been pushed to Cloudflare by using the command below.
1. Get user groups
$ curl -X GET -H "Authorization: Bearer $AOT" https://api.cloudflare.com/client/v4/accounts/$ACCT/iam/user_groups | jq .
{
    "errors": [],
    "messages": [],
    "result": [
        {
            "created_on": "2025-01-24T15:31:36.759979Z",
            "id": "f234f49f66df4db8864c5189fe78c87f",
            "modified_on": "2025-01-24T15:35:50.151764Z",
            "name": "My Cool Demo Group",
            "status": "V"
        },
        {
            "created_on": "2025-01-16T20:43:01.019311Z",
            "id": "7148c1e4d9f247f5b6dcd3ef20f998f9",
            "modified_on": "2025-01-16T20:44:07.627233Z",
            "name": "My Cool Demo Group, now with policies!",
            "policies": [
                {
                    "access": "allow",
                    "created_on": "2025-01-16T20:44:07.627233Z",
                    "id": "8d82cf8c15c64e07a4bee58e00d80bca",
                    "modified_on": "2025-01-16T20:44:07.627233Z",
                    "permission_groups": [
                        {
                            "created_on": "2023-06-21T18:58:29.907496Z",
                            "id": "a1a099e3256942259bfde18c688b67d5",
                            "meta": {
                                "description": "Grants write access to Page Shield for domain",
                                "editable": "false",
                                "label": "domain_page_shield",
                                "scopes": "com.cloudflare.api.account.zone"
                            },
                            "modified_on": "2023-06-21T18:58:29.907496Z",
                            "name": "Domain Page Shield",
                            "permissions": ["dev note: snipped for length"],
                            "status": "V"
                        }
                    ],
                    "resource_groups": [
                        {
                            "created_on": "2025-01-16T20:44:07.627233Z",
                            "modified_on": "2025-01-16T20:44:07.627233Z",
                            "scope": {
                                "key": "com.cloudflare.api.account.a3324a084cd290080b563ab39c91545a",
                                "objects": [
                                    {
                                        "key": "*"
                                    }
                                ]
                            }
                        }
                    ],
                    "status": "V"
                }
            ],
            "status": "V"
        }
    ],
    "result_info": {
        "count": 2,
        "page": 1,
        "per_page": 100,
        "total_count": 2,
        "total_pages": 1
    },
    "success": true
}
2. Make a query against the resource ID
Locate the tag of the group you pushed from the IdP and use it to make a direct query against its resource ID:
export PUSHED_GROUP='...' # Pull this value from the "id" json field in the group list response
$ curl -XGET -H "Authorization: Bearer $AOT" https://api.cloudflare.com/client/v4/accounts/$ACCT/iam/user_groups/$PUSHED_GROUP | jq .
The response for this should have the group name that was specified in the identity provider with no attached policies.
3. Review available permission groups
Before you modify the group's policies, review the available permission groups (roles) on the account by querying its API.
$ curl -XGET -H "Authorization: Bearer $DEMO_AOT" https://api.cloudflare.com/client/v4/accounts/$ACCT/iam/permission_groups | jq .
{
  "result": [
    {
      "id": "1a0fc8bdeae24387b64d5b8de1ad052a",
      "name": "Administrator Read Only",
      "status": "V",
      "meta": {
        "description": "Can access the full account in read-only mode.",
        "editable": "false",
        "label": "admin_readonly",
        "scopes": "com.cloudflare.api.account"
      },
      "created_on": "2020-07-06T12:19:13.099114Z",
      "modified_on": "2020-10-13T11:18:00.208228Z"
    },
    {
      "id": "ce2c69b09baf4ca38223910a8b7e07a9",
      "name": "Administrator",
      "status": "V",
      "meta": {
        "description": "Can access the full account, except for membership management and billing.",
        "editable": "false",
        "label": "admin",
        "scopes": "com.cloudflare.api.account"
      },
      "created_on": "2020-07-06T12:19:13.099114Z",
      "modified_on": "2020-10-13T11:18:00.208228Z"
    }
  ],
  "success": true,
  "errors": [],
  "messages": []
}
:::note
These permission groups are from our staging environment and tags will not function in your production deployment.
:::
Inspect Group Members
To verify the IdP synchronized the group and user members pushed in the SCIM operation, query the Group Members API.
$ curl -XGET -H "Authorization: Bearer $DEMO_AOT" https://api.cloudflare.com/client/v4/accounts/$ACCT/iam/user_groups/$PUSHED_GROUP/members | jq .
{
  "result": [
    {
      "id": "a4366a09c43a0b0c4606dc5528472bb6",
      "email": "luke.skywalker@rebelalliance.net"
    },
    {
      "id": "0329c17f6c13f5202dc38d2036efb1a9",
      "email": "arya.stark@winterfell.place"
    }
  ],
  "result_info": {
    "page": 1,
    "per_page": 100,
    "total_pages": 1,
    "count": 2,
    "total_count": 2
  },
  "success": true,
  "errors": [],
  "messages": []
}

Available RSS Feeds
Cloudflare offers various RSS feeds as part of our changelog, which helps you stay up to date on new features and functionality.
For more details on how these feeds are structured, refer to Consuming RSS Feeds.
Related resources
Planned maintenance windows
Subscribe to Cloudflare Status

Consuming RSS Feeds
Our changelogs are published to various RSS feeds with HTML in the 
<description> tag.
In feeds with multiple products, such as the global or product-area feeds, the products associated with a given entry are in the 
<category> tag.
A single product will also appear in the custom 
<product> tag for legacy reasons, but we recommend you use the 
<category>
Example XML
<rss version="2.0">
	<channel>
		<title>Cloudflare changelogs</title>
		<description>Updates to various Cloudflare products</description>
		<link>https://developers.cloudflare.com/changelog/</link>
		<item>
			<title>Agents, Workers, Workflows - Build AI Agents with Example Prompts</title>
			<link>https://developers.cloudflare.com/changelog/2025-02-14-example-ai-prompts/</link>
			<guid isPermaLink="true">https://developers.cloudflare.com/changelog/2025-02-14-example-ai-prompts/</guid>
			<description>
				<p>
					We've added an <a href="https://developers.cloudflare.com/workers/get-started/prompting/">example prompt</a> to help you get started with building AI agents and applications on Cloudflare ...
				</p>
			</description>
			<pubDate>Fri, 14 Feb 2025 19:00:00 GMT</pubDate>
			<product>Agents</product>
			<category>Agents</category>
			<category>Workers</category>
			<category>Workflows</category>
		</item>
	</channel>
</rss>
Related resources
You can surface RSS feeds in several different providers, including:
Slack
Microsoft Teams
Google Chat

RSS Feeds
Cloudflare offers several RSS feeds to help you consume content programmatically.

Authorizing an application
Overview
When you authorize a third-party OAuth application, you grant it permission to access specific Cloudflare resources on your behalf. Cloudflare provides tools to view, manage, and revoke these authorizations at any time.
Authorize a third-party application
When a third-party application requests access to your Cloudflare account, you will see a consent screen that displays:
Application name and logo: The name and branding of the requesting application
Publisher domain: The domain and verification status of the application publisher
Account selection: Choose which Cloudflare account(s) the application can access
Requested permissions: After selecting the account(s) the application may access, the specific scopes the application is requesting will be displayed before consent is complete. You can also decline optional permissions. To finish the authorization process, review the permissions the application is requesting and select “Authorize”
Each shield icon indicates who owns the application and whether its domain ownership is verified:
Green filled shield: Cloudflare owns and manages the application.
Blue outlined shield: A third-party application with verified ownership of its domain.
Amber filled shield: A third-party application without verified ownership of a domain.
Domain verification only confirms that the application owner controls the displayed domain.
Edit optional permissions
All requested permissions are selected by default. You can turn off optional permissions, but required permissions remain selected. Select Read only to include only optional scopes with read access, or Full access to include all optional scopes. If the client has no permissions configured as optional, editing controls do not appear.
1. In **Additional access**, select **Edit Permissions**.
2. Turn permissions on or off individually or by category.
3. Select **Authorize** to grant required and selected optional permissions.
View and revoke authorized applications
Application authorizations may be viewed and revoked at any time from the profile page on the Cloudflare dashboard.
1. Log in to the Cloudflare dashboard.
2. 
https://dash.cloudflare.com/?to=/profile/access-management/authorization
3. View the list of applications you have authorized.
   - If you wish to revoke access to an application, select the “Revoke” button for that row
Account administrator controls
If an account is not available for selection during the consent flow, it may be due to an administrator of that account disabling access to account resources via OAuth.
Account administrators can restrict OAuth applications from accessing account resources via Manage Account > Members > Settings > Public OAuth App access.
:::caution
This will not prevent existing authorizations account members may already have in place, and will only prevent new authorizations from accessing account resources.
:::

Create your OAuth client
Prerequisites
To create an OAuth client, you must have one of these roles for the associated account: Super Administrator, Administrator, or OAuth Client Write.
Dashboard
		1. Log in to the Cloudflare dashboard.
		2. Select your account.
		3. Go to **Manage Account** > **OAuth clients**.
		4. Select **Create client**.
		5. Enter the required configuration details:
			- Client name
			- Response type
			- Grant type
			- Token authentication method
			- Redirect URLs
		6. Optional: Add non-required fields.
		7. Select **Continue** and define the scopes required for your client.
		8. Optional: In **Choose optional scopes**, turn off **Required** for each scope you want to make optional. All scopes are required by default.
		9. Select **Create client**.
		10. Save your **Client ID** and **Client Secret** in a secure location.
https://dash.cloudflare.com/?to=/:account/oauth-clients
API
	To create OAuth clients with the Cloudflare API, create an API token with the `OAuth Clients Write` permission.
	```bash
	curl -X POST "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/oauth_clients" \
		-H "Content-Type: application/json" \
		-H "Authorization: Bearer $API_TOKEN" \
		-d '{
			"client_name": "Cloudflare OAuth Client",
			"grant_types": ["authorization_code"],
			"redirect_uris": ["https://example.com/oauth/callback"],
			"scopes": ["workers-platform.read", "workers-platform.write"],
			"optional_scopes": ["workers-platform.read"],
			"post_logout_redirect_uris": ["https://example.com/logout"],
			"response_types": ["code"],
			"token_endpoint_auth_method": "client_secret_basic",
			"logo_uri": "https://example.com/logo.png",
			"policy_uri": "https://example.com/policy",
			"tos_uri": "https://example.com/tos",
			"client_uri": "https://example.com",
			"allowed_cors_origins": ["https://example.com"]
		}'
	```
:::note
After you create an OAuth client, Cloudflare displays the client secret if the client requires one. Copy it to a secure location. You cannot view the secret again after you leave the page. If you lose the secret, rotate it to get a new one.
:::
Select scopes
OAuth scope names correspond to Cloudflare API token permission names. Use the Cloudflare API documentation to identify the permissions your client needs.
Dashboard
	When you create or edit an OAuth client, select at least one scope. All selected scopes are required by default.
	In **Choose optional scopes**, turn off **Required** for each scope you want to make optional.
	Required scopes must be granted on the consent screen, while optional scopes can be declined by the user.
API
	Fetch the available scopes from the API. Use the scope ID when you create a client through the API.
	```bash
	curl "https://api.cloudflare.com/client/v4/oauth/scopes" \
		-H "Content-Type: application/json" \
		-H "Authorization: Bearer $API_TOKEN"
	```
	
	To mark scopes as optional, include them in the `optional_scopes` of the request. This must be a subset of the `scopes` for the client. Optional scopes may be declined by the user during authorization.
Supported OAuth flows
Cloudflare OAuth clients support the OAuth 2.0 Authorization Code flow.
Cloudflare does not support Client Credentials, Implicit, Resource Owner Password Credentials, Device Authorization, or other OAuth grant types for third-party clients.
Choose a flow
Use the following guidance to choose an OAuth flow:
Client type
Flow
Token endpoint authentication
PKCE
Server-side web app or backend service
Authorization Code with a client secret
client_secret_basic or 
client_secret_post
Optional/not required
Browser-based, mobile, desktop, or CLI app
Authorization Code with PKCE
none
Required, 
S256
Client secret
The Authorization Code flow is intended for secure server-side applications that can protect a client secret from exposure.
Use when: Your OAuth client is a server-side web application or backend service.
How it works: Your client redirects the user to the authorization page. After authorization, Cloudflare returns an authorization code to your backend. Your backend exchanges the code and client secret for an access token.
Security note: Never expose your client secret in client-side code or embed it in mobile client binaries.
PKCE
Proof Key for Code Exchange (PKCE) extends the Authorization Code flow for public clients, such as mobile or single-page apps, where a client secret cannot be securely stored.
Use when: Your OAuth client is a single-page, mobile, desktop, or CLI application.
How it works: Your application generates a unique code verifier and code challenge for every login request instead of using a static client secret.
Security note: Clients that use PKCE do not need a client secret.
Private and public clients
New OAuth clients default to private visibility. Private clients can only be authorized by members of the parent Cloudflare account. Public clients allow authorization from any Cloudflare user.
Before you make a client public, complete the required actions and populate the required fields.
Required fields
Client name
Logo
Client URL
Scopes
Required actions
OAuth clients must complete domain verification for the client URL before they can be made public.
Promote a client to public
:::caution
Setting a client's visibility to public is permanent. You cannot change the visibility back to private.
:::
Dashboard
		1. Go to **Manage Account** > **OAuth clients**.
		2. Open the action menu for your client.
		3. Select **Change Visibility**.
https://dash.cloudflare.com/?to=/:account/oauth-clients
API
	```bash
	curl -X PATCH "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/oauth_clients/$CLIENT_ID" \
		-H "Content-Type: application/json" \
		-H "Authorization: Bearer $API_TOKEN" \
		-d '{ "visibility": "public" }'
	```
Client URL domain ownership verification
Cloudflare requires client URL domain ownership verification before a client can become public. If your client is only for private use by members of the account, domain ownership verification is not required.
:::caution
After Cloudflare verifies domain ownership, you cannot change the domain of the client URL. You can still update the route for that domain.
:::
Copy the verification code and create a 
TXT record in your DNS configuration with that value. The record must include all text, including the 
cloudflare_oauth_client_publisher= prefix.
Cloudflare polls this DNS record until it is found or until the request times out after two days.
Restart verification
Dashboard
	If the verification process times out, select **Restart verification** in the client action menu.
API
	To restart a failed or timed out verification, send a `PATCH` request with the existing `client_uri` unchanged.
	```bash
	curl -X PATCH "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/oauth_clients/$CLIENT_ID" \
		-H "Content-Type: application/json" \
		-H "Authorization: Bearer $API_TOKEN" \
		-d '{ "client_uri": "https://example.com" }'
	```
Rotate client secrets
Each client can have two secrets. This lets you create a new secret, update your client to use the new secret, and delete the old secret.
Dashboard
		1. Go to **Manage Account** > **OAuth clients**.
		2. Open the action menu for your client.
		3. Select **Rotate client secret**.
		4. Save the new secret in a secure location.
		5. After your client uses the new secret, delete the old secret.
https://dash.cloudflare.com/?to=/:account/oauth-clients
API
	To check whether a client is in the middle of a secret rotation, look for `has_rotated_secret` in the `GET` response. If the value is `true`, delete the old secret before you create another secret.
	#### Create a new secret
	```bash
	curl -X POST "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/oauth_clients/$CLIENT_ID/rotate_secret" \
		-H "Content-Type: application/json" \
		-H "Authorization: Bearer $API_TOKEN"
	```
	#### Delete the old secret
	```bash
	curl -X DELETE "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/oauth_clients/$CLIENT_ID/rotate_secret" \
		-H "Content-Type: application/json" \
		-H "Authorization: Bearer $API_TOKEN"
	```

OAuth Applications on Cloudflare
Availability
Free
Pro
Business
Enterprise
Availability
Yes
Yes
Yes
Yes

Integrate your OAuth client with Cloudflare
After registering an application, use these endpoints to integrate your OAuth client with Cloudflare.
Jwks: 
https://dash.cloudflare.com/.well-known/jwks.json
Open ID config: 
https://dash.cloudflare.com/.well-known/openid-configuration
Authorization: 
https://dash.cloudflare.com/oauth2/auth
Token: 
https://dash.cloudflare.com/oauth2/token
Revoke: 
https://dash.cloudflare.com/oauth2/revoke
Session logout: 
https://dash.cloudflare.com/oauth2/logout
User info: 
https://dash.cloudflare.com/oauth2/userinfo

Organizations for Enterprise
Organizations provides a single-tier structure for Enterprise customers to manage multiple Cloudflare accounts from one unified dashboard.
Who is this for?
Organizations is designed for Enterprise customers of any size who manage multiple Cloudflare accounts. Whether you manage a few accounts or thousands, Organizations helps you manage them from one dashboard.
Common use cases:
Multi-brand companies managing separate accounts per brand
Regional operations with accounts per geography
Business units or subsidiaries with independent accounts
Development workflows with separate accounts per environment
Growing companies consolidating account management
Looking for MSSP (Managed Security Service Provider) or Distributor documentation? Refer to Organizations for MSSP and Distributors.
Hierarchy structure
Enterprise Organizations use a single-tier structure:
Organization
├── Account 1
│   ├── Zone A
│   └── Zone B
├── Account 2
│   ├── Zone C
│   └── Zone D
└── Account 3
    └── Zone E
Key characteristics:
One Organization contains multiple accounts
Each account can contain multiple zones
All accounts are at the same level (no sub-organizations)
Organization members have implicit access to all accounts
Maximum: 20,000 accounts and 200,000 zones per Organization
Example: Company A
Company A is a SaaS company with 12 Cloudflare accounts:
3 accounts for different product lines (Product Alpha, Product Beta, Product Gamma)
3 environments per product (Development, Staging, Production)
Each account manages its own zones and configurations
Before Organizations:
Security team manually copies WAF rules to all 12 accounts
Admins switch between accounts individually
No unified view of traffic or security events
Each new admin needs explicit access to all 12 accounts
With Organizations:
Create one Organization containing all 12 accounts
Security team creates WAF rules once, shares to all production accounts
Admins see all accounts in one dashboard with the enhanced account switcher
View aggregate HTTP analytics across all accounts
New Organization members automatically get access to all 12 accounts
Use tags to organize accounts by product line and environment
Set up your Organization
Prerequisites
Before you create an Organization:
Your user must have Super Admin role access to an account with an Enterprise plan.
You (the Organization creator) must have two-factor authentication (2FA) or single sign-on (SSO) enabled on your Cloudflare user account. This is a per-user requirement — 2FA/SSO is not an account-level setting.
You must be a Super Administrator on the accounts you want to assign. You can add accounts of any plan type (eg Enterprise, or Free).
Each Organization supports a maximum of 20,000 accounts and 200,000 zones. Refer to Limitations for details.
You may only create a single Organization. You, or another member of your company, must not have already created an Organization.
Your accounts must not already belong to another Organization.
Create an Organization
Log in to the Cloudflare dashboard.
Select Organizations.
Select Create organization.
Enter a name for the Organization.
Select Create.
The Organization overview page displays after creation.
Assign accounts
After creating an Organization, you can assign existing accounts to manage them centrally. You can add accounts of any plan type (eg Enterprise, or Free) as long as you are a Super Administrator of the account.
From the Organization overview, select Assign an account.
Search for an account name. Only accounts where you are a Super Administrator will appear.
Select the account.
Select Assign to organization.
The assigned account now appears on the Organization overview page. From here, you can view the account, copy its ID, or rename it.
To remove an account from your Organization, contact Cloudflare Support.
Create new accounts
Organization Super Administrators can create up to five Free accounts within an Enterprise Organization.
Log in to the Cloudflare dashboard and go to Accounts.
https://dash.cloudflare.com/
Select Create Account.
Enter an account name.
For Organization, select the destination Organization.
Select Create Account.
The new account starts on the Free plan. It does not inherit payment methods, plans, subscriptions, or entitlements from the Organization.
API tokens and OAuth access tokens cannot create accounts within an Organization.
Manage members
Organization Super Administrator
When you create an Organization, you become the Organization Super Administrator. This role provides implicit access to all accounts in your Organization and allows you to manage memberships at the Organization level.
:::note
Organization Super Administrator is the only Organization-level role available today. All Organization members have the same level of access. Additional roles (read-only, billing, audit log) will be available in a future release.
:::
:::note
Any Organization Super Administrator can add or remove other Organization Super Administrators at any time.
:::
Implicit access
Organization members receive implicit access to all accounts in the Organization. Implicit access means:
You do not need explicit membership on each individual account.
When you go to any account within your Organization, you automatically have Super Administrator permissions on that account.
Implicit access is granted at the Organization level — you cannot grant implicit access to a subset of accounts.
Implicit access is equivalent to Super Administrator. There is no read-only implicit access today.
Implicit access is separate from any existing per-account membership. If you were already an explicit member of an account before it was added to the Organization, that existing membership is unaffected.
Invite members
You can invite additional members to your Organization. Invited members receive implicit Super Administrator access to all accounts in the Organization.
From the Organization overview, select Members.
Select Invite member.
Enter the email address.
Select Send invitation.
The user receives an email invitation. After accepting, they have implicit access to all accounts in the Organization.
Member authentication requirements
All users who will be Organization members must have two-factor authentication (2FA) or single sign-on (SSO) enabled on their Cloudflare user account before they can accept an Organization invitation. This is a per-user requirement, not an account-level setting.
If a user does not have 2FA or SSO enabled, they will not be able to accept the invitation.
Ask the user to enable 2FA or SSO first, then resend the invitation.
For instructions on enabling 2FA, refer to Set up 2FA.
For SSO configuration, refer to Dashboard SSO.
Share policies
Organizations allows you to share WAF custom rulesets and Zero Trust Gateway policies (DNS, Network, HTTP, Resolver) across accounts in your Organization. Shared policies are read-only in receiving accounts and automatically stay in sync when updated in the source account.
Organizations also supports IdP federation, which lets you configure a single identity provider (such as Okta or Entra ID) in one account and share it across all accounts in your Organization. Shared IdP connections are read-only in recipient accounts and are automatically provisioned or removed as accounts join or leave the Organization.
For detailed instructions, refer to Policy sharing.
:::note
Policy sharing requires the appropriate entitlements. Organizations does not grant access to WAF or Gateway features — your accounts must already have the required Enterprise WAF or Zero Trust Gateway SKUs.
:::
View aggregate analytics
You can view, filter, and download aggregate HTTP analytics across all accounts in your Organization:
From the Organization overview, select Analytics & Logs.
Use filters to narrow results by date range, account, domain, or other criteria.
To export data, select Download.
The data includes traffic for proxied hostnames and may be based on a sample. This data does not reflect billable usage.
Manage your Organization
Rename your Organization
Go to Organizations > Manage Organization.
Next to Organization name, select Rename.
Enter the new name.
Select Rename.
Edit customer identification data
Go to Organizations > Manage Organization.
Next to Customer identification data, select Edit.
Update the information.
Select Save.
View audit logs
Organization audit logs capture user-initiated actions performed by Organization Super Administrators through Organization-level APIs and the dashboard. These logs are separate from account-level audit logs — actions performed within a specific account continue to appear in that account's audit logs.
To view Organization audit logs in the dashboard:
Go to Organizations > Manage Organization.
Select Audit Logs.
You can also retrieve Organization audit logs via the API:
GET https://api.cloudflare.com/client/v4/organizations/{organization_id}/logs/audit
If you are viewing account-level audit logs and the account belongs to an Organization where you are an Organization Super Administrator, you can select View Organization Audit Logs to go to the parent Organization's audit logs.
For more details on audit log structure, filtering, and retention, refer to Audit Logs — Organization Activity Logs.
API
You can manage Organizations programmatically using the Cloudflare Organizations API. The API supports creating, updating, deleting Organizations, managing members, and assigning accounts.
Terraform
You can manage Organizations using the Cloudflare Terraform provider.
:::note
To manage Organization resources through their full Terraform lifecycle, configure the provider with a Global API key and the registered account email. User API Tokens support only some Organization operations. Refer to API authentication.
:::
What you cannot do
Create sub-organizations
Enterprise Organizations use a flat structure. You cannot create sub-organizations or nested containers. Use tags to organize accounts by business unit, region, or environment.
Move accounts
Accounts cannot be moved between Enterprise Organizations.
If you encounter errors during setup, refer to Troubleshooting.

Organizations for MSSP and Distributors
Organizations provides a multi-tier structure for MSSP (Managed Security Service Provider) and Distributor partners to manage customer accounts and create child partner Organizations.
Who is this for?
Organizations for MSSP and Distributors is designed for:
Distributors managing multiple MSSP partner Organizations
MSSPs managing multiple end-customer accounts
Channel partners providing managed Cloudflare services
Looking for Enterprise documentation? Refer to Organizations for Enterprise.
Hierarchy structure
MSSP/Distributor Organizations use a multi-tier structure:
Distributor Organization
├── MSSP Organization A
│   ├── Sub-Organization A1
│   │   ├── Customer Account 1
│   │   │   ├── Zone A
│   │   │   └── Zone B
│   │   └── Customer Account 2
│   │       └── Zone C
│   └── Customer Account 3
│       └── Zone D
├── MSSP Organization B
│   ├── Customer Account 4
│   │   └── Zone E
│   └── Customer Account 5
│       └── Zone F
└── MSSP Organization C
    └── Sub-Organization C1
        └── Customer Account 6
            └── Zone G
Key characteristics:
Distributors create and manage child MSSP Organizations
MSSP Organizations can create up to 5 levels of nested sub-organizations
Each MSSP Organization manages its own customer accounts
MSSP Organization members have implicit access to their customer accounts
Accounts can be moved between MSSP Organizations
Maximum: 20,000 accounts and 200,000 zones per Organization
Example: Distributor A
Distributor A is a Cloudflare channel partner with 15 MSSP partners:
Each MSSP partner manages 5-50 end-customer accounts
Total: 15 MSSP Organizations, 300+ customer accounts
Distributor A's structure:
Distributor A Organization
├── Security MSSP
│   ├── Retail Customer 1 (10 zones)
│   ├── Healthcare Customer 2 (25 zones)
│   └── Finance Customer 3 (40 zones)
├── Web Performance MSSP
│   ├── E-commerce Customer 4 (15 zones)
│   └── Media Customer 5 (30 zones)
└── [13 more MSSP Organizations...]
What Distributor A can do:
Create new MSSP Organizations for new partners
Create customer accounts within each MSSP Organization
Move customer accounts between MSSP Organizations if ownership changes
View aggregate analytics across all MSSP Organizations
Share security policies across MSSP Organizations
What each MSSP can do:
Manage their own customer accounts
Create new customer accounts for new clients
Invite MSSP team members with implicit access to all customer accounts
Share WAF and Gateway policies across their customer accounts
View aggregate analytics across their customer accounts
Set up your Organization
MSSP/Distributor Organizations cannot be self-serve created by customers. To get started:
Contact your Cloudflare account team to request an MSSP or Distributor Organization.
Cloudflare will create your Organization and assign the initial Organization Super Administrator.
The initial Organization Super Administrator must have two-factor authentication (2FA) or single sign-on (SSO) enabled on their Cloudflare user account.
Once created, the Organization Super Administrator can begin managing the Organization from the Cloudflare dashboard.
:::note
Organization type (Enterprise vs MSSP/Distributor) is set at creation and cannot be changed. If you need a different type, a new Organization must be created.
:::
Create child MSSP Organizations
Distributors can create child MSSP partner Organizations. Each MSSP Organization operates independently and manages its own customer accounts.
Create new accounts
MSSP Organizations can self-serve create new customer accounts within their Organization. Enterprise Organizations can self-serve create up to five Free accounts within their Organization.
Move accounts between Organizations
Move customer accounts from one MSSP Organization to another when ownership changes or customers switch providers.
Manage members
Distributor and MSSP Organization Super Administrators can add and manage Organization members directly from the Cloudflare dashboard. No support ticket is required.
Organization Super Administrator
When your Organization is created, the initial user becomes the Organization Super Administrator. This role provides implicit access to all accounts in your Organization and allows you to manage memberships at the Organization level.
:::note
Organization Super Administrator is the only Organization-level role available today. All Organization members have the same level of access. Additional roles (read-only, billing, audit log) will be available in a future release.
:::
:::note
Any Organization Super Administrator can add or remove other Organization Super Administrators at any time.
:::
Implicit access
Organization members receive implicit access to all accounts in the Organization. Implicit access means:
You do not need explicit membership on each individual account.
When you go to any account within your Organization, you automatically have Super Administrator permissions on that account.
Implicit access is granted at the Organization level — you cannot grant implicit access to a subset of accounts.
Implicit access is equivalent to Super Administrator. There is no read-only implicit access today.
For Distributor Organizations, implicit access applies within each tier — Distributor admins access all child MSSP Organizations and their accounts.
Implicit access is separate from any existing per-account membership. If a user was already an explicit member of an account before it was added to the Organization, that existing membership is unaffected.
Invite members
You can invite additional members to your Organization. Invited members receive implicit Super Administrator access to all accounts in the Organization.
From the Organization overview, select Members.
Select Invite member.
Enter the email address.
Select Send invitation.
The user receives an email invitation. After accepting, they have implicit access to all accounts in the Organization.
Member authentication requirements
All users who will be Organization members must have two-factor authentication (2FA) or single sign-on (SSO) enabled on their Cloudflare user account before they can accept an Organization invitation. This is a per-user requirement, not an account-level setting.
If a user does not have 2FA or SSO enabled, they will not be able to accept the invitation.
Ask the user to enable 2FA or SSO first, then resend the invitation.
For instructions on enabling 2FA, refer to Set up 2FA.
For SSO configuration, refer to Dashboard SSO.
Share policies
Organizations allows you to share WAF custom rulesets and Zero Trust Gateway policies (DNS, Network, HTTP, Resolver) across accounts in your Organization. Shared policies are read-only in receiving accounts and automatically stay in sync when updated in the source account.
For Distributor Organizations, policies can be shared across MSSP Organization boundaries within the same Distributor Organization.
Organizations also supports IdP federation, which lets you configure a single identity provider (such as Okta or Entra ID) in one account and share it across all accounts in your Organization. Shared IdP connections are read-only in recipient accounts and are automatically provisioned or removed as accounts join or leave the Organization.
For detailed instructions, refer to Policy sharing.
:::note
Policy sharing requires the appropriate entitlements. Organizations does not grant access to WAF or Gateway features — your accounts must already have the required Enterprise WAF or Zero Trust Gateway SKUs.
:::
View aggregate analytics
You can view, filter, and download aggregate HTTP analytics across all accounts in your Organization:
From the Organization overview, select Analytics & Logs.
Use filters to narrow results by date range, account, domain, or other criteria.
To export data, select Download.
The data includes traffic for proxied hostnames and may be based on a sample. This data does not reflect billable usage.
Manage your Organization
Rename your Organization
Go to Organizations > Manage Organization.
Next to Organization name, select Rename.
Enter the new name.
Select Rename.
Edit customer identification data
Go to Organizations > Manage Organization.
Next to Customer identification data, select Edit.
Update the information.
Select Save.
View audit logs
Organization audit logs capture user-initiated actions performed by Organization Super Administrators through Organization-level APIs and the dashboard. These logs are separate from account-level audit logs — actions performed within a specific account continue to appear in that account's audit logs.
To view Organization audit logs in the dashboard:
Go to Organizations > Manage Organization.
Select Audit Logs.
You can also retrieve Organization audit logs via the API:
GET https://api.cloudflare.com/client/v4/organizations/{organization_id}/logs/audit
If you are viewing account-level audit logs and the account belongs to an Organization where you are an Organization Super Administrator, you can select View Organization Audit Logs to go to the parent Organization's audit logs.
For more details on audit log structure, filtering, and retention, refer to Audit Logs — Organization Activity Logs.
API
You can manage Organizations programmatically using the Cloudflare Organizations API. The API supports creating, updating, deleting Organizations, managing members, and assigning accounts.
Terraform
You can manage Organizations using the Cloudflare Terraform provider.
:::note
To manage Organization resources through their full Terraform lifecycle, configure the provider with a Global API key and the registered account email. User API Tokens support only some Organization operations. Refer to API authentication.
:::
If you encounter errors during setup or management, refer to Troubleshooting.
What you cannot do (today)
Assign existing accounts
MSSP/Distributor Organizations cannot assign existing accounts. Use account creation to add new accounts to your Organization.

Organizations
An Organization is a top-level container in Cloudflare for managing multiple accounts. It allows administrators to govern accounts, members, and resources from a single location rather than managing each account individually. Organization Super Administrators have implicit access to all accounts within the Organization. This means they do not need explicit membership on each account.
Who is this for?
Organizations is available to Enterprise customers of any size and MSSP/Distributor partners who manage multiple Cloudflare accounts. Whether you manage a few accounts or thousands, Organizations helps you manage them from one dashboard.
Organizations supports two customer types, each with a different structure:
Enterprise Organizations: A single-tier structure for businesses managing their own accounts. One Organization contains multiple accounts directly.
MSSP/Distributor Organizations: A multi-tier structure for channel partners and managed security service providers (MSSPs). A Distributor Organization contains child MSSP Organizations, each managing their own customer accounts.
Organization type is set at creation and cannot be changed.
Enterprise hierarchy
Organization
├── Account 1
│   ├── Zone A
│   └── Zone B
├── Account 2
│   ├── Zone C
│   └── Zone D
└── Account 3
    └── Zone E
MSSP/Distributor hierarchy
Distributor Organization
├── MSSP Organization A
│   ├── Sub-Organization A1
│   │   ├── Customer Account 1
│   │   │   ├── Zone A
│   │   │   └── Zone B
│   │   └── Customer Account 2
│   │       └── Zone C
│   └── Customer Account 3
│       └── Zone D
└── MSSP Organization B
    ├── Customer Account 4
    │   └── Zone E
    └── Customer Account 5
        └── Zone F
MSSP/Distributor Organizations support up to 5 levels of nested sub-organizations.
Core features
Centralized account management: Manage all accounts from a single dashboard.
Implicit access: Organization Super Administrators can access any account in the Organization without requiring explicit per-account membership.
Aggregate analytics: View, filter, and download aggregate HTTP analytics across all Organization child accounts.
Organization-level membership: Invite members to the Organization once, granting them access to all child accounts.
WAF and Gateway policy sharing: Create security policies once and share them across accounts in your Organization.
IdP federation: Share a single identity provider configuration across all accounts in your Organization. Refer to IdP federation for setup details.
API, SDK, and Terraform support: Manage Organizations programmatically with the Cloudflare Organizations API, SDKs, or Terraform provider. User API Tokens support some Organization operations, but they cannot complete the full Terraform resource lifecycle. Refer to API authentication.
Enhanced account switcher: Navigate between accounts with an Organization-aware account switcher in the dashboard.
For a full list of features and limitations specific to each Organization type, refer to the Enterprise or MSSP/Distributor guide.

Limitations and troubleshooting
The following limitations currently apply to Cloudflare Organizations. For common errors and resolutions, refer to Troubleshooting.
Account and zone limits
Each Organization supports a maximum of 20,000 accounts and 200,000 zones. This limit applies to both Enterprise and MSSP/Distributor Organizations. These limits are defaults and can be adjusted for larger enterprises and partners in some cases.
API authentication
The following credentials support core Organization management operations and Terraform:
Operation
Supported credentials
List Organizations
Global API key, or user API token with User Details Read or User Details Write
Create an Organization
Global API key, or user API token with User Details Write
Read, update, or delete an Organization
Global API key
List accounts directly attached to an Organization; view or update its profile; manage its members
Global API key
Accept or reject an Organization invitation
Global API key or user API token for the invited user; no additional token permission
Create and manage an Organization with Terraform (
cloudflare_organization resource)
Global API key and the registered email address
Look up an existing Organization with Terraform (
cloudflare_organization data source)
Global API key and the registered email address
List Organizations with Terraform (
cloudflare_organizations data source)
Global API key and the registered email address, or user API token with User Details Read or User Details Write
A supported credential must belong to a user with the required access.
User API tokens cannot currently receive the Organization-scoped permissions required by operations that require a Global API key. Prefer user API tokens where the table supports them. When you use a Global API key, also provide the user's registered email address. A Global API key has full access to the user's Cloudflare resources. Refer to Global API key limitations.
Organization audit logs and billing usage are separate subresources outside this matrix.
Account moves and other account-scoped operations are also outside this matrix. Refer to each endpoint's Security and Accepted Permissions sections, including move account to an Organization, get account profile, and update account profile.
Enterprise Organizations
Limitation
Description
Organization creation
You must be a Super Administrator of an Enterprise account to create an Organization.
Adding accounts
You can add accounts of any plan type (eg Enterprise, or Free) to your Organization. You must have Super Administrator access to the account, and it cannot already belong to another Organization.
Account creation
Organization Super Administrators can create up to five Free accounts within their Organization. API tokens and OAuth access tokens cannot create accounts within an Organization. Refer to Create new accounts.
Sub-Organizations
Not available. Enterprise Organizations use a flat, single-tier structure. Use tags to organize accounts by business unit, region, or environment.
Moving accounts
Accounts cannot be moved between Organizations.
Roles
Organization Super Administrator is the only role available. Additional roles (read-only, billing, audit log) will be available in a future release.
Organization deletion
To delete an Organization, use the API. Dashboard support is not yet available.
Account removal
Self-service account removal is not yet available. To remove an account from your Organization, contact Cloudflare Support.
MSSP/Distributor Organizations
Limitation
Description
Organization creation
MSSP/Distributor Organizations are created by Cloudflare. Contact your account team to set up your Organization.
Adding existing accounts
Assigning existing accounts is not available for MSSP/Distributor Organizations. Use account creation to add new accounts.
Account creation
MSSP Organizations can self-serve create new customer accounts within their Organization.
Sub-Organizations
Distributors can create child MSSP Organizations. MSSP/Distributor Organizations support up to 5 levels of nested sub-organizations.
Moving accounts
Accounts can be moved between MSSP Organizations within the same Distributor Organization.
Roles
Organization Super Administrator is the only role available. Additional roles (read-only, billing, audit log) will be available in a future release.
Organization deletion
To delete an Organization, use the API. Dashboard support is not yet available.
Account removal
Self-service account removal is not yet available. To remove an account from your Organization, contact Cloudflare Support.
Organization type conversion
Organization type (Enterprise vs MSSP/Distributor) is set at creation and cannot be changed. To switch types, a new Organization must be created.
Troubleshooting
You may encounter the following errors when setting up or managing an Organization.
Organization creation errors
Error
Description
Organization management is only available on the Enterprise plan at this time.
You are not a member of any Enterprise accounts. You must be a Super Administrator of at least one Enterprise account to create an Organization.
You need a super admin role on an enterprise account to create an Organization.
You are not a Super Administrator of an Enterprise account. Check your role under Manage Account > Members on your Enterprise account.
One or more of your enterprise accounts is already part of an Organization.
Your accounts are already assigned to an Organization. Contact your company administrator to be invited to the existing Organization.
You have reached the maximum number of organizations.
Each user can only create one Organization. If you need to manage a second Organization, contact Cloudflare Support.
An Organization has already been created for accounts associated with your company. Please contact your company administrator.
Every company is limited to one Organization for all business units. Contact your company's Cloudflare administrator to be invited to the existing Organization.
You are not eligible to create an Organization because we think there's a problem. Please contact Cloudflare support and we will help you create it.
This rare error may indicate an issue with the internal metadata for one or more of your accounts. Contact Cloudflare Support with your account ID and the error message.
Member invitation errors
Error
Resolution
Invited member cannot accept the invitation.
The invited user must have two-factor authentication (2FA) or single sign-on (SSO) enabled on their Cloudflare user account before they can accept an Organization invitation. This is a per-user requirement, not an account-level setting. Ask the user to enable 2FA or SSO, then resend the invitation.
Member does not have access to accounts after accepting.
Organization membership grants implicit access, which may take a few minutes to propagate. If access does not appear after 5 minutes, ask the member to log out and log back in.
Account assignment errors
Error
Resolution
Account does not appear in the assignment list.
You must be a Super Administrator of the account. Verify your role under Manage Account > Members on that account.
Account cannot be assigned.
The account may already belong to another Organization. Each account can only belong to one Organization. Contact Cloudflare Support if you believe this is incorrect.

Manage members
Member management is covered within each Organization type guide:
Organizations for Enterprise — Invite members, manage Organization Super Administrators, and understand implicit access for Enterprise Organizations.
Organizations for MSSP and Distributors — Invite members, manage Organization Super Administrators, and understand implicit access for MSSP/Distributor Organizations.

Manage organizations
Organization management (rename, edit settings, Terraform) is covered within each Organization type guide:
Organizations for Enterprise — Rename, edit customer identification data, and manage with Terraform for Enterprise Organizations.
Organizations for MSSP and Distributors — Rename, edit customer identification data, and manage with Terraform for MSSP/Distributor Organizations.

Policy sharing
Organizations allows you to create security policies in one account and share them across other accounts in your Organization. This ensures consistent security posture across all accounts without manually duplicating configurations.
Policy sharing works the same way for both Enterprise and MSSP/Distributor Organizations.
In addition to WAF and Gateway policies, Organizations supports IdP federation, which lets you configure a single identity provider (such as Okta or Entra ID) in one account and share it across all accounts in your Organization. Shared IdP connections are read-only in recipient accounts and are automatically provisioned or removed as accounts join or leave the Organization.
Prerequisites
Policy sharing requires the appropriate product entitlements on the accounts involved. Organizations does not grant access to WAF or Gateway features — your accounts must already have the required SKUs.
WAF policy sharing requires Enterprise WAF entitlements on both the source and destination accounts.
Gateway policy sharing requires Zero Trust Gateway entitlements on both the source and destination accounts.
WAF policy sharing
Create WAF custom rulesets in one account and share them to other accounts within your Organization.
How it works
Create a WAF custom ruleset in a source account — this is the account where you author and manage the rules.
Share the ruleset to one or more destination accounts within your Organization.
The shared ruleset appears in the destination accounts as a read-only policy.
Changes made to the ruleset in the source account automatically propagate to all destination accounts.
Key behaviors
Read-only in destination accounts: Shared WAF policies cannot be edited in the receiving accounts. To modify the rules, update them in the source account.
Destination accounts cannot have their own account-level custom rules: Sharing takes over the account-level WAF custom rules phase in each destination account. While a share is active, the destination account cannot deploy its own account-level custom rulesets. If a destination account already has account-level custom rules, the shared ruleset is not applied until those rules are removed. Zone-level custom rules, rate limiting rules, and managed rulesets in the destination account are not affected.
Source account owns the policy: If the source account is removed from the Organization, the shared policy is removed from all destination accounts.
No cross-Organization sharing: Policies can only be shared within a single Organization. You cannot share policies between different Organizations.
Multiple rulesets: You can share multiple WAF custom rulesets from the same or different source accounts.
Share a WAF custom ruleset
In the source account, go to Security > WAF > Custom rules.
Create or select a custom ruleset.
From the ruleset action menu, select Share.
In the sharing dialog, select one or more destination accounts.
Select Share.
The shared ruleset now appears in the destination accounts under their WAF custom rules.
Gateway policy sharing
Share Zero Trust Gateway policies across accounts in your Organization. Gateway policy sharing supports the following policy types:
DNS policies — Filter and block DNS queries.
Network policies — Control network-level traffic.
HTTP policies — Inspect and filter HTTP traffic.
Resolver policies — Customize DNS resolution behavior.
How it works
Create a Gateway policy in a source account.
Share the policy to one or more destination accounts within your Organization.
The shared policy appears in the destination accounts as a read-only policy.
Changes made to the policy in the source account automatically propagate to all destination accounts.
Key behaviors
Read-only in destination accounts: Shared Gateway policies cannot be edited in the receiving accounts. To modify the policy, update it in the source account.
Source account owns the policy: If the source account is removed from the Organization, the shared policy is removed from all destination accounts.
All Gateway policy types supported: DNS, Network, HTTP, and Resolver policies can all be shared.
Zero Trust seat requirements: Destination accounts must have their own Zero Trust seats and Gateway entitlements.
Manage shared policies
View shared policies
From the Organization overview, you can see which policies are shared and to which accounts. Shared policies are marked with a sharing indicator in the destination account's policy list.
Remove a shared policy
To stop sharing a policy with a destination account:
In the source account, go to the shared policy.
Select Manage sharing.
Remove the destination account from the sharing list.
The policy is immediately removed from the destination account.
Best practices
Centralize policy authoring: Designate one or two accounts as your policy source accounts. This simplifies management and ensures consistency.
Use descriptive names: Name shared policies clearly (for example, "Org-Wide OWASP Rules" or "Global DNS Block List") so destination account admins understand what the policy does.
Test before sharing: Validate policies in the source account before sharing to all destination accounts to avoid unintended blocks or rule conflicts.
Monitor shared policy coverage: Regularly review which accounts have shared policies applied to ensure no accounts are missing critical security rules.

Set up
Organizations setup varies depending on your Organization type. Choose the guide that matches your use case:
Organizations for Enterprise — For Enterprise customers managing their own accounts. Includes self-serve Organization creation, account assignment, and member management.
Organizations for MSSP and Distributors — For MSSP and Distributor partners managing customer accounts and child Organizations. Includes account creation, sub-org management, and account movement.

Improve SEO
The goal of Search Engine Optimization (SEO) is to get your website to rank higher on various search engine providers (Google, Bing, etc.).
In practice, SEO is primarily about quality content, user experience, and not making things more difficult for search engine crawlers. While Cloudflare cannot write quality content for you, our service can help with user experience — especially related to site speed — and search crawlers.
:::note[Tip:]
For general guidelines around SEO, refer to Google's recommendations.
:::
SEO improvements with Cloudflare
Several Cloudflare features improve Search Engine site rankings. However, meaningful and regularly updated site content is still crucial to improving SEO.
Increase site speed
Since at least 2010, Google has publicly stated that site speed affects your Google ranking.
Cloudflare offers multiple features to optimize site performance.
Enable HTTPS
Since search engines use HTTPS as a ranking signal, HTTPS is vital for SEO.
To make sure your domain is accessible over HTTPS:
Get an SSL/TLS certificate for your domain.
Redirect visitors to the HTTPS version of your domain.
Enable Crawler Hints
With Crawler Hints, search engines and other bot-powered experiences have the freshest version of your content, translating into happier users and ultimately influencing search rankings.
Troubleshooting
Depending on your domain's security settings, you might accidentally block search engine crawlers.
If you notice SEO issues, make sure your:
WAF custom rules are allowing Verified Bots.
Rate limiting rules are allowing Verified Bots.
Bot protection settings are not blocking Verified Bots.
If you still notice issues with search engine crawlers, refer to our Troubleshooting guide.
Common misconceptions
The following characteristics do not affect your domain's SEO:
Changing your nameservers: Using Cloudflare's nameservers does not affect your domain's SEO.
Server location: According to Google, server location is not important for SEO.
Sites sharing IP addresses: Search engines do not generally penalize domains using shared IP addresses unless several of these sites are malicious or spammy.
Cloudflare caching: When Cloudflare caches your content, it actually speeds up content delivery and only improves SEO. Our caching does not create duplicate content, rewrite URLs, or create additional subdomains.

Performance


Maintenance mode
If you need to make large changes to your website, you may want to make your site temporarily unavailable.
With code
If you are familiar with code, create a Worker that returns an HTML page to any site visitors.
Without code
Business and Enterprise
For a maintenance page without code, Business and Enterprise uses can create a Cloudflare Waiting Room.
Certain customization and queue options depend on your plan.
All plans
Users on all plans can create an Access application. Make sure to limit your Access policy to only include yourself and any collaborators.
If needed, you can also further customize the login page.

Minimize downtime
When making any change to the routing of an Internet application, there is always a possibility of downtime due to certificate issuance, misconfigured settings, or limitations at your origin server. To avoid downtime when going live, it is important to review the most common configurations.
Update and review DNS records
Before activating your domain on Cloudflare (exact steps depend on your DNS setup), review the DNS records in your Cloudflare account.
Start with unproxied records
With a new domain, make sure all of your DNS records have a proxy status of DNS-only.
This setting prevents Cloudflare from proxying your traffic before you have an active edge certificate or before you have allowed Cloudflare IP addresses.
Confirm record accuracy
Take extra time to confirm the accuracy of your DNS records before activating your domain, paying special attention to:
Zone apex records (
example.com)
Subdomain records (
www.example.com or 
blog.example.com)
Email records
If you add DNS records to your authoritative DNS provider between onboarding your domain and activating your domain, you may need to also add these records within Cloudflare.
Activate your domain
Finish the DNS setup for your domain, moving the domain status to Active:
Full setups: Update the authoritative nameservers at your registrar and wait for that change to be authenticated.
Partial setups: Add the verification TXT record to your authoritative DNS and wait for that change to be authenticated.
Verify SSL/TLS edge certificates
Before proxying your traffic through Cloudflare, verify that Cloudflare has an active Edge Certificate for your domain.
For more details about timing and certificate recommendations, refer to Certificate issuance.
Optional - Test configuration
You may want to test your configuration using your local machine or proxying traffic from a development domain or subdomain.
If you experience issues, you should make sure that you have allowed Cloudflare IP addresses at your origin server.
Update proxy status
Once you have verified that your SSL/TLS edge certificate is active and you have allowed Cloudflare IP addresses, change the proxy status of appropriate DNS records to Proxied.

Test speed
Cloudflare offers several tools to test the speed of your website, as well as the speed of your Internet connection.
Test website speed
Using Cloudflare
Once your domain is active on Cloudflare, you can run speed tests within the Cloudflare dashboard.
This speed test will provide information about critical loading times, performance with and without Cloudflare's proxy, and recommended optimizations.
If you experience any issues, make sure you are not blocking specific user agents.
Using third-party tools
If your domain is not yet active on Cloudflare or you want to measure the before and after improvements of using Cloudflare, Cloudflare recommends using the following third-party tools:
PageGym
GTmetrix
DebugBear
Lighthouse
WebPageTest
If you use these third-party tools, you should do the following to test website speed:
Pause Cloudflare to remove performance and caching benefits.
Run a speed test.
Unpause Cloudflare.
Run a speed test[^1].
Run a second speed test to get your baseline performance with Cloudflare.
[^1]: The results of your first speed test with Cloudflare will likely contain uncached results, which will provide inaccurate results.
One of the key ways Cloudflare speeds up your site is through caching, which will appear in the results of the second test.
Improve speed
Based on the results of these speed tests, you may want to explore other ways to optimize your site speed using Cloudflare.
:::note
Cloudflare does not consider Time to First Byte (TTFB) the most important measure of page load speed. If you are concerned about a slower TTFB while using Cloudflare, refer to our blog post about Cloudflare and TTFB.
:::
Test Internet speed
To test the speed of your home network connection (download, update, packet loss, ping measurements, and more), visit speed.cloudflare.com.

Account and domain management best practices
More and more of our lives revolve around our online presence and maintaining access to our various online accounts, such as social media, banking, personal, and business accounts. These accounts are critical to remaining connected with our loved ones and business. As such, ensuring a level of continuity with these services is critical. Below is a list of important items to help ensure you are able to maintain access or delegate access to your Cloudflare account in the event that you are unable to manage your account.
You can lose access to your account and or domain for several reasons: Death, divorce, disgruntled employee, or simply missing an email notification.
To help prevent loss of access:
Decentralize access to your account.
Protect yourself by following good password management practices.
Maintain control of your domain name.
Save your 2FA backup keys.
Relationships, partnerships, and business ventures
Ensuring equal access with your partner, spouse, or your business partner is important to ensuring your account or domain names remain active.
If you have a domain name or a portfolio of domain names for your business, ensuring you have a strict organization policy when it comes to vendor account creation or domain name registration is critical. The steps below will ensure your organization is the owner of the account and or domain names:
Ensure the registrant of the domain name is your organization's name.
Ensure the vendor account is in your organization's name.
Ensure that access to the email address used to set up these accounts is decentralized, but can still be used to send emails. Do not use a distribution list email address.
Email addresses
If you are operating a business, use an email address that is not tied to the domain name itself, such as 
john@example.com; instead, use one of the many well known email providers as best practice. Additionally, the email address itself should be one that is shared with your business partner with a name such as 
ourbusiness@example.com. This is important because many companies require the person who is contacting them for support have access to the email address associated with the account.
Billing information
Most if not all online services have automated billing processes that will attempt to bill the current or default credit card on file. Maintaining your billing information to avoid any payment failure is critical, as this can cause service disruptions if there is a failed billing attempt that is not resovlved in a timely manner.
Deceased account holder or registrant
While often overlooked, an important part of having an online presence is ensuring continuity in the event of an unexpected accident or incapacitation of the account holder. Create clear instructions for domain or account management in the event the account holder is unable to administer the account. If no account access instructions were left by the deceased, Cloudflare may be able to assist you.

/cdn-cgi/ endpoint
When you add a domain to Cloudflare, Cloudflare adds a 
/cdn-cgi/ endpoint (
www.example.com/cdn-cgi/) to that domain.
This endpoint is managed and served by Cloudflare. It cannot be modified or customized. The endpoint is not used by every Cloudflare product, but you may find some products use the endpoint in its URL.
:::note
Traffic to 
/cdn-cgi/ endpoints is classified as Served by Cloudflare in Security Analytics.
:::
A few examples include (but are not limited to):
Identify the Cloudflare data center serving your request, which is helpful for troubleshooting (
https://<YOUR_DOMAIN>/cdn-cgi/trace).
JavaScript detection used by Cloudflare bot products (
example.com/cdn-cgi/challenge-platform/)
Image transformations in the new URLs you would use for images (
example.com/cdn-cgi/image/)
Email address obfuscation used to hide email addresses from malicious bots (
example.com/cdn-cgi/l/email-protection)
Web analytics for a website proxied through Cloudflare (
example.com/cdn-cgi/rum). This endpoint returns a 
204 HTTP status code.
Speed Brain adds an HTTP header called 
Speculation-Rules to web page responses. This header contains a URL that hosts an opinionated Speculation-Rules configuration, which instructs the browser to initiate prefetch requests for anticipated future navigations.
Recommended exclusions
Exclude from security scanners
Some scanners may display an error because certain 
/cdn-cgi/ endpoints do not have an HSTS setting applied to it or for similar reasons. Because the endpoint is managed by Cloudflare, you can ignore the error and do not need to worry about it.
To prevent scanner errors, omit the 
/cdn-cgi/ endpoint from your security scans.
Disallow using robots.txt
/cdn-cgi/ also can cause issues with various web crawlers.
Search engine crawlers can encounter errors when crawling these endpoints and — though these errors do not impact site rankings — they may surface in your webmaster dashboard.
SEO and other web crawlers may also mistakenly crawl these endpoints, thinking that they are part of your site's content.
As a best practice, update your 
robots.txt file to include 
Disallow: /cdn-cgi/.
:::note
If you serve transformations through Images, a blanket 
Disallow: /cdn-cgi/ prevents search engines from indexing your transformed images served from 
/cdn-cgi/image/. To allow crawlers to discover these images, add an 
Allow rule before the 
Disallow:
Allow: /cdn-cgi/image/
Disallow: /cdn-cgi/
The more specific 
Allow path takes precedence over the broader 
Disallow, so crawlers will still be blocked from other 
/cdn-cgi/ endpoints.
:::

Cloudflare Ray ID
A Cloudflare Ray ID is an identifier given to every request that goes through Cloudflare.
Ray IDs are particularly useful when evaluating Security Events for patterns or false positives or more generally understanding your application traffic.
Ray IDs are added as a request header, cf-ray, to the connection from Cloudflare to the origin web server.
As such the Ray IDs can be found using the Developer Tools in your browser or using curl with the 
-v option to show the headers.
:::caution
Ray IDs are not guaranteed to be unique for every request. In some situations, different requests may have the same Ray ID.
:::
Look up Ray IDs
Security events
All customers can view Ray IDs and associated information — IP address, user agent, ASN, etc. — by looking through sampled logs in Security Events.
Additionally, you can add filters to look for specific Ray IDs.
Please note that Security Events may use sampled data to improve performance. If sampled data is applied to your search, you might not see all events, and filters might not return the expected results. To display more events, select a smaller timeframe.
Observability Logs
Log Explorer (Legacy) provides access to Cloudflare logs with all the context available within the Cloudflare platform. If your account has the Log Explorer add-on, go to Observability > Logs in the dashboard and build a query that filters for a specific Ray ID to investigate HTTP errors.
Logs
Enterprise customers can enable Ray ID as a field in their Cloudflare Logs.
Server logs
For more details about sending Ray IDs to your server logs, refer to the Cf-Ray header.

Cloudflare crawlers
Cloudflare may crawl or make HTTP requests to your site to make sure its protected and performing properly.
Crawling situations
Specific products
Cloudflare will crawl your site when you have specific products enabled:
Always Online
User-Agent: 
Mozilla/5.0 (compatible; CloudFlare-AlwaysOnline/1.0; +http://www.cloudflare.com/always-online)
Health checks
User-Agent: 
Mozilla/5.0 (compatible; Cloudflare-Healthchecks/1.0; +https://www.cloudflare.com/; healthcheck-id: <HEALTHCHECK_ID>)
HEALTHCHECK_ID is a 16-character string associated with the health check ID.
Load balancing monitors
User-Agent: 
Mozilla/5.0 (compatible; Cloudflare-Traffic-Manager/1.0; +https://www.cloudflare.com/traffic-manager/; pool-id: <POOL_ID>)
POOL_ID is a 16-character string associated with the load balancing pool ID being monitored.
Prefetch URLs
User-Agent: 
Mozilla/5.0 (compatible; CloudFlare-Prefetch/0.1; +http://www.cloudflare.com/)
SSL/TLS recommender
User-Agent: 
Cloudflare-SSLDetector
This crawler ignores your 
robots.txt file unless there are rules explicitly targeting the user agent.
Security Insights
User-Agent: 
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36 (compatible; +https://developers.cloudflare.com/security-center/)
Other situations
Cloudflare will also crawl your site in other, specific situations:
Speed tests
User-Agent: 
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36 PTST/190628.140653
Triggered when: You launch a speed test from within the Cloudflare dashboard.
Support diagnostics:
User-Agent: 
Cloudflare-diagnostics
Triggered when: Cloudflare Support Engineers perform error checks and by continuous monitoring used to raise intelligent alerts in the Cloudflare dashboard.
Custom Hostname validation:
User-Agent: 
Cloudflare Custom Hostname Verification
Triggered when: You choose to validate a custom hostname with an HTTP ownership token.
Developer product crawlers
Browser Run is a Cloudflare developer product that can crawl third-party websites on behalf of Cloudflare customers. Unlike the crawlers in the Crawling situations section, it does not crawl your site as part of a Cloudflare service you have enabled. It is used by developers building applications with Cloudflare's platform.
The Browser Run /crawl endpoint uses a User-Agent of 
CloudflareBrowserRenderingCrawler/1.0. For non-configurable headers, bot detection IDs, and cryptographic verification methods you can use to identify or block Browser Run traffic, refer to Automatic request headers.
AI Search is a Cloudflare developer product that indexes your website content so it can be searched. The AI Search crawler only crawls a website you own (the domain must exist in the same Cloudflare account) that you select as your data source in AI Search.
The crawler uses a User-Agent of 
Cloudflare-AI-Search. You can allow or block it with WAF rules using its bot detection ID.

Cloudy AI agent (beta)
Cloudy is Cloudflare's first version of an AI agent, with assistant-like functionality designed to help users understand and improve their Cloudflare configurations in multiple areas of the product suite.
Cloudy is powered by Workers AI and helps identify and solve issues such as identifying redundant rules, optimizing execution order, analyzing conflicting rules, and identifying disabled rules. Cloudy can also help investigate threat events and provide actionable recommendations.
Availability
Cloudy, currently in beta, is available in several Cloudflare products such as WAF, Zero Trust, and Analytics. Throughout the rest of 2025, Cloudflare plans to roll out additional AI agent capabilities across other areas of Cloudflare.
:::note[Send us your feedback]
We want to hear your thoughts as you get to meet Cloudy and try out these new AI features. You can send feedback to us at cloudyfeedback@cloudflare.com. Your feedback will help shape our roadmap for AI enhancement, and bring our users smarter, more efficient tooling that helps everyone get more secure.
:::
What data does Cloudy have access to?
Cloudy has access to your Cloudflare configuration. It combines this data with a purpose-built LLM prompt.
Additionally, Cloudy takes Role-Based Access Control (RBAC) restrictions into account: it can only access the same Cloudflare configuration settings as the currently logged in user, based on their roles and permissions.
All your configuration information is only included in the purpose-built prompt — it is not used to train Cloudy or the LLM model(s) powering it.
Is Cloudy trained on user or customer data?
No. Your Cloudflare configuration is used in the purpose-built prompt that enables Cloudy to turn raw configuration data into consistent, clear summaries and actionable recommendations.
Cloudy does not share your Cloudflare configuration with other customers. Your configuration is also not used for LLM model training.
Cloudy brings the same enterprise-grade security as the rest of Cloudflare's offerings. You can learn more about Cloudflare's approach to responsible AI in the Trust Hub.
Can I opt out of Cloudy?
Currently, Cloudflare does not provide an opt out mechanism that completely disables all possible use of Cloudy. You can only opt out of the chat interface available in the Cloudflare dashboard.
However, Cloudy is an entirely optional tool that you can choose not to use. By not using Cloudy, you will not get summaries based on your current configuration or any actionable recommendations.
To opt out of the chat interface, do the following:
Log in to the Cloudflare dashboard and select your account.
Go to Manage Account > Configurations.
Turn off the Cloudy features setting.
As noted above, Cloudy is not trained on user or customer data and does not share your Cloudflare setup with other customers.

Connection limits
When HTTP/HTTPS traffic is proxied through Cloudflare, there are often two established TCP connections: the first is between the requesting client to Cloudflare and the second is between Cloudflare and the origin server. Each connection has their own set of TCP and HTTP limits, which are documented below.
Between client and Cloudflare
Type
Limit (seconds)
HTTP status code at limit
Configurable
Connection Keep-Alive HTTP/1.1
400
TCP connection closed
No
Connection Idle HTTP/2
400
TCP connection closed
No
Between Cloudflare and origin server
What connection means here
A TCP connection is established when its TCP handshake completes. For a new TCP-based HTTPS connection, setup also requires SSL/TLS negotiation. TCP can therefore be established while HTTPS setup remains unfinished.
Requests can reuse established connections, and a proxied request may traverse multiple connections. A connection timeout does not, by itself, identify which operation timed out or what caused it. Reused connections and QUIC do not have the same per-request TCP/TLS setup sequence as a new TCP-based HTTPS connection.
The TCP establishment and request-acknowledgment rows describe specific TCP timeout conditions. They are not an exhaustive list of every operation that can produce 522. Neither value is a universal TCP-plus-TLS setup budget. A timeout while TLS remains pending can be reported as 
522 rather than 525.
:::note
If you are using Cloudflare tunnels, refer to Origin configuration to view or modify your connection settings.
:::
Type
Limit (seconds)
HTTP status code at limit
Configurable
TCP connection establishment
19
522
No
TCP request acknowledgment timeout
90
522
No
TCP Keep-Alive Interval
30
520
No
Proxy Idle Timeout
900
520
No
Proxy Read Timeout
125
524
Yes, for Enterprise zones
Proxy Write Timeout
30
524
No
HTTP/2 Pings to Origin
Off
-
Yes
HTTP/2 Connection Idle
900
No
No
Configurable limits
Some TCP connections can be customized for Enterprise customers. Reach out to your account team for more details.
Keep-Alives
Cloudflare maintains keep-alive connections to improve performance and reduce cost of recurring TCP connects in the request transaction as Cloudflare proxies customer traffic from its global network to the site's origin server.
Ensure HTTP keep-alive connections are enabled on your origin. Cloudflare reuses open TCP connections up to the 
Proxy Idle Timeout limit after the last HTTP request. Origin web servers close TCP connections if too many are open. HTTP keep-alive helps avoid connection resets for requests proxied by Cloudflare.
Request limits
URLs have a limit of 16 KB. Request headers have a total limit of 128 KB.
Response limits
Response headers observe a total limit of 128 KB.
Cache limits
Refer to the Cache documentation for more details about the max upload size and the cacheable file size limits.

Cryptographic Attestation of Personhood
Cloudflare developed an alternative to CAPTCHA authentication, the Cryptographic Attestation of Personhood (CAP).
CAP lets you prove that you are a legitimate website visitor by touching a hardware key, instead of solving a CAPTCHA puzzle.
This article provides answers to common questions about usability and privacy concerns.
You can also test CAP by going to the demo site.
Privacy questions
The answer to most privacy concerns are summarized in this table:
Property
Cloudflare could
Cloudflare does
Collect biometrics (fingerprints or face pictures)
No
N/A
Collect information about your hardware authenticator
Yes, limited to the number of keys in your batch
Yes, when available
No, Cloudflare cannot collect biometrics. Our CAP process uses the WebAuthn API, which prevents the collection of biometrics by default. When your device asks for a biometric authentication — such as via a fingerprint sensor — it all happens locally. 
As such, we never see your biometric data: that remains on your device. Once your device confirms a match, it sends only a basic attestation message. In effect, your device sends a message proving “yes, someone correctly entered a fingerprint on this trustworthy device” and never sends the fingerprint itself.
Yes, Cloudflare does collect a limited amount of data about your key. We store the manufacturer of your key and batch identifier (minimum of 100,000 keys per batch) for verification purposes. From our perspective, your key looks like all other keys in the batch.
Some self-signed keys and keys from certain manufacturers have been found to not meet this requirement and should be avoided if you are minimizing your online privacy risk.
For more details on how we set up Cryptographic Attestation of Personhood, refer to the introductory blog post.
What devices are and are not allowed?
Allowed devices
CAP supports a wide variety of hardware authenticators:
Roaming (cross-platform) authenticators:
Supported: All security keys found in the FIDO Metadata Service 3.0, unless they have been revoked for security reasons.
Examples: YubiKeys, HyperFIDO keys, Thetis FIDO U2F keys
Platform authenticators:
Examples: Apple Touch ID and Face ID on iOS mobile devices and macOS laptops; Android mobile devices with fingerprint readers; Windows Hello
Known limitations
Most combinations of web browsers and WebAuthn-capable authenticators will work, but there are some known compatibility issues with WebAuthn attestation that may prevent CAP from working successfully:
Basic CAP:
macOS desktop: For TouchID, browser must be Safari
Android: Browser must be Chrome
CAP with Zero-Knowledge Proof:
Apple platform authenticators (e.g., iPhone with Touch ID/Face ID) are incompatible with the zero-knowledge proof system. If this fails, you will immediately be redirected to basic CAP route without having to take any further action. Since Apple uses a privacy-preserving Apple Anonymous Attestation to show that an authenticator is valid while blocking tracking, this method maintains a high standard of privacy.
We are updating this list as the ecosystem evolves and as we continue to test different combinations.
Can hackers bypass the Cryptographic Attestation of Personhood?
CAP is one of many techniques to identify and block bots. To date, we have seen some attempts to test CAP’s security system, such as one thoughtfully-executed, well-documented test. The blog post discussing the test specifically calls out that this method does not break the Cloudflare threat model.
This does not mean that CAP is broken, but rather shows that it raises the cost of an attack over the current CAPTCHA model.
What happens if I lose my key?
If you do not have the necessary hardware (such as a Yubikey), you can still solve a regular CAPTCHA challenge (e.g., selecting pictures).
What are the common error codes and what do they mean?
Unsupported_att_fmt:
Cause: Your authenticator is using an unsupported attestation format (combination of browser and key). Also occurs when you use Firefox and select the option to "anonymise your key".
Solution: If this error occurs during zero-knowledge version of CAP, you will automatically be redirected to the basic CAP flow. If basic CAP fails, try a different combination of supported hardware device and browser or opt for a CAPTCHA.
Unsupported_issuer:
Cause: Your key is currently not supported.
Solution: Use a supported key.
Related resources
https://cloudflarechallenge.com (demo site)
Introducing Cryptographic Attestation of Personhood (blog)
Expanding Crypotgraphic Attestation of Personhood (blog)
Introducing Zero-Knowledge Proofs (blog)

Error responses
When Cloudflare cannot complete a request, it generates an error response. The format depends on what the client requests via the 
Accept header and on the zone's Custom Errors configuration.
By default, error responses are HTML. Clients that request a structured format (such as 
application/json, 
application/problem+json, or 
text/markdown) receive a machine-readable response instead. This machine-readable response covers all 1xxx error codes (which return HTTP 4xx or 5xx status codes depending on the error) and Cloudflare-generated 5xx errors (500, 502, 504, 520-526). Responses for 5xx errors generated by the origin server are passed through by Cloudflare to the client and are not affected.
:::note
This page covers the format of Cloudflare-generated error responses. For converting origin page content to Markdown, refer to Markdown for Agents. For replacing default error pages with custom content, refer to Custom Errors.
:::
Content negotiation
Cloudflare selects the response format based on the client's 
Accept header, following standard HTTP content negotiation. When multiple formats are acceptable, quality factors (
q values) determine precedence. At the same quality value, the first-listed type wins.
Accept header sent
Response format
application/json
JSON (
application/json; charset=utf-8)
application/problem+json
JSON (
application/problem+json; charset=utf-8)
application/json, text/markdown;q=0.9
JSON (higher quality factor)
text/markdown
Markdown (
text/markdown; charset=utf-8)
text/markdown, application/json
Markdown (equal quality, first-listed wins)
text/*
Markdown
text/html
HTML
*/*
HTML
Not set
HTML
Structured error responses are available on all plans, including the Free plan. Custom Error Rules for overriding these responses require a Cloudflare paid plan.
Interaction with Custom Errors
Structured error responses are the default for zones with no custom error configuration. Zones that use Custom Errors retain full control over what clients receive.
What a client receives depends on which custom error features your zone has configured. Refer to the following sections for details.
No custom error page, no custom error rules
This is the default for most zones. Cloudflare serves its default error response in the format the client requests.
Client sends
Response
Accept: application/json
Default Cloudflare structured JSON response
Accept: text/markdown
Default Cloudflare structured Markdown response
Accept: text/html
Default Cloudflare HTML error page
No 
Accept header
Default Cloudflare HTML error page
Error Page configured, no custom error rules
The zone has an Error Page uploaded via the Cloudflare dashboard. No Custom Error Rules are configured. The Error Page is served to all clients regardless of 
Accept header — Error Pages do not perform content negotiation.
Client sends
Response
Accept: application/json
Your custom HTML error page
Accept: text/markdown
Your custom HTML error page
Accept: text/html
Your custom HTML error page
No 
Accept header
Your custom HTML error page
If you want agents to receive structured responses while keeping your custom HTML for browsers, add a Custom Error Rule that matches on the 
Accept header. Refer to the next section for details.
Custom Error Rules configured
The zone has one or more Custom Error Rules (available on paid plans). These take priority over Error Pages. You control what gets served, to whom, and under what conditions.
Client sends
Response
Accept: application/json
If a Custom Error Rule matches, the rule's content is served. If no rule matches, falls back to the Error Page (if configured) or the structured JSON response.
Accept: text/markdown
If a Custom Error Rule matches, the rule's content is served. If no rule matches, falls back to the Error Page (if configured) or the structured Markdown response.
Accept: text/html
If a Custom Error Rule matches, the rule's content is served. If no rule matches, falls back to the Error Page or the default HTML.
No 
Accept header
Same fallback chain
Custom Error Rules can match on any request header including 
Accept, and can target specific error codes. You can serve JSON to API clients, Markdown to agents, and HTML to browsers, all from the same zone.
Example: Serve custom JSON to API clients on a 522 error
This Custom Error Rule matches 522 errors where the client requests JSON:
Expression: 
(http.response.code eq 522) and (any(http.request.headers["accept"][*] contains "application/json"))
Action: Serve a custom JSON response with your own error format.
This rule takes priority over both the default structured JSON response and any configured Error Page. Clients that do not match the rule (for example, browsers requesting HTML) fall through to the Error Page or the default Cloudflare response.
Example: Serve structured responses to agents and a custom HTML page to browsers
If your zone has an Error Page configured, it is served to all clients, including agents requesting JSON or Markdown. To let agents receive Cloudflare's default structured responses instead, remove the Error Page. Without an Error Page, Cloudflare respects the 
Accept header automatically: agents get structured JSON or Markdown and browsers get HTML.
If you need to keep the Error Page for browsers but want to serve custom structured content to agents, create Custom Error Rules that match on the 
Accept header and serve your own JSON or Markdown content. Browsers that do not match either rule continue to receive your custom HTML Error Page.
Priority order
When Cloudflare generates an error response, the following priority order determines what the client receives:
Custom Error Rules — If a rule matches the error and request conditions, the rule's content is served.
Error Pages — If an Error Page is configured for the error type and no Custom Error Rule matched, the Error Page is served as HTML regardless of the 
Accept header.
Structured error responses — If no Custom Error Rule matched and no Error Page is configured, Cloudflare serves its default response in the format the client requested (JSON, Markdown, or HTML).
For the full priority order including account-level versus zone-level rules, WAF custom block responses, and security challenge pages, refer to the Custom Errors documentation.
Examples
JSON: 522 Connection timed out
{
	"type": "https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-522/",
	"title": "Error 522: Connection timed out",
	"status": 522,
	"detail": "Cloudflare could not establish a TCP connection to the origin server. The TCP handshake timed out, which may indicate the origin is overloaded, firewalling Cloudflare, or unreachable at the network level.",
	"instance": "9f140b785e57c458",
	"error_code": 522,
	"error_name": "connection_timeout",
	"error_category": "origin",
	"ray_id": "9f140b785e57c458",
	"timestamp": "2026-04-24T09:22:40Z",
	"zone": "example.com",
	"cloudflare_error": true,
	"retryable": true,
	"retry_after": 120,
	"owner_action_required": true,
	"what_you_should_do": "**Wait and retry.** Back off for at least 120 seconds. If the error persists, the website operator should verify firewall rules and ensure the origin accepts connections from Cloudflare IP ranges.",
	"footer": "This error was generated by Cloudflare on behalf of the website owner."
}
Markdown: 522 Connection timed out
---
error_code: 522
error_name: connection_timeout
error_category: origin
status: 522
ray_id: 9f140b785e57c458
timestamp: 2026-04-24T09:22:40Z
zone: example.com
cloudflare_error: true
retryable: true
retry_after: 120
owner_action_required: true
---
# Error 522: Connection timed out
## What Happened
Cloudflare could not establish a TCP connection to the origin server. The TCP handshake timed out, which may indicate the origin is overloaded, firewalling Cloudflare, or unreachable at the network level.
## What You Should Do
**Wait and retry.** Back off for at least 120 seconds. If the error persists, the website operator should verify firewall rules and ensure the origin accepts connections from Cloudflare IP ranges.
---
This error was generated by Cloudflare on behalf of the website owner.
Test structured error responses
Fetch the structured JSON response for a 522 error:
curl --silent --compressed --header "Accept: application/json" \
  --user-agent "TestAgent/1.0" --header "Accept-Encoding: gzip, deflate" \
  "https://example.com/cdn-cgi/error/522" | jq .
Fetch the structured Markdown response:
curl --silent --compressed --header "Accept: text/markdown" \
  --user-agent "TestAgent/1.0" --header "Accept-Encoding: gzip, deflate" \
  "https://example.com/cdn-cgi/error/522"
Check for the 
Retry-After header on a retryable error:
curl --silent --compressed --dump-header - --output /dev/null \
  --header "Accept: application/json" --user-agent "TestAgent/1.0" \
  --header "Accept-Encoding: gzip, deflate" \
  "https://example.com/cdn-cgi/error/521" | grep -i retry-after
Response fields
Both JSON and Markdown responses contain the same set of fields. JSON responses return them as a flat object; Markdown responses place them in YAML frontmatter followed by prose sections. The field definitions below apply to both formats.
JSON responses follow RFC 9457 (Problem Details for HTTP APIs). Any HTTP client that understands Problem Details can parse the five standard members (
type, 
title, 
status, 
detail, 
instance) without Cloudflare-specific code.
RFC 9457 standard members
Field
Type
Description
type
string
URI pointing to Cloudflare documentation for this error code.
title
string
Short summary, for example, 
"Error 522: Connection timed out".
status
integer
HTTP status code of the response.
detail
string
Plain-text explanation of what went wrong and which party is responsible.
instance
string
Ray ID identifying this specific error occurrence.
Cloudflare extension members
Field
Type
Description
error_code
integer
Cloudflare error code (for example, 
522, 
1015).
error_name
string
Machine-readable name in 
snake_case (for example, 
connection_timeout, 
rate_limited). Stable — suitable for programmatic matching.
error_category
string
Fault classification. Refer to Error categories. Stable — suitable for programmatic matching.
ray_id
string
Same value as 
instance. Included for compatibility with existing Cloudflare tooling.
timestamp
string
ISO 8601 timestamp of when the error was generated.
zone
string
The requested hostname.
cloudflare_error
boolean
Always 
true. Confirms this error was generated by Cloudflare, not the origin.
retryable
boolean
Whether the error is transient and the request can be retried.
retry_after
integer or null
Seconds to wait before retrying. Present only when 
retryable is 
true. Matches the 
Retry-After HTTP header value.
owner_action_required
boolean
Whether the site operator needs to take action to resolve the error.
what_you_should_do
string
Actionable guidance for the client: what to do next, whether to retry, and who can fix the problem.
footer
string
Attribution line.
Markdown-specific structure
Markdown responses place these fields in YAML frontmatter (between 
--- delimiters), followed by three prose sections:
# Error {code}: {description} — heading with the error code and short description.
## What Happened — corresponds to the 
detail field.
## What You Should Do — corresponds to the 
what_you_should_do field.
The frontmatter omits the RFC 9457 standard members (
type, 
title, 
instance) and the 
footer field since these are either redundant with the prose or not applicable to the Markdown format.
Error categories
The 
error_category field classifies the fault so that clients can route retry and escalation behavior without parsing the prose fields.
5xx error categories
Category
Codes
Meaning
Retry?
origin
502, 504, 520-524
The origin server is responsible. Transient infrastructure failure.
Yes. Back off using 
retry_after.
cloudflare
500
Cloudflare encountered an internal error. The origin was not necessarily involved.
Yes. Short retry (30s).
ssl
525, 526
The origin's TLS configuration is broken (handshake failure or invalid certificate).
No. Retrying will not help until the operator fixes the TLS configuration.
1xxx error categories
Category
Meaning
Example codes
access_denied
IP blocks, country blocks, firewall rules
1005, 1006, 1007, 1008, 1010, 1012, 1106-1109
rate_limit
Rate limiting
1015, 1025, 1027, 1200
dns
DNS resolution errors
1001, 1016
config
Zone or origin configuration errors
1004, 1014, 1033, 1043, 1047, 1049
tls
Client TLS errors (version, cipher, certificate)
1017, 1028, 1029, 1044
legal
Legal restrictions (DMCA, country blocks)
1026, 1039
worker
Worker script errors
1042, 1100, 1101, 1102, 1103, 1104, 1105
rewrite
URL rewrite rule errors
1036, 1037
snippet
Snippet configuration errors
1201, 1202, 1203, 1204, 1205, 1206
unsupported
Unsupported features or protocols
1045
Retry-After header
Retryable error codes include a standard 
Retry-After HTTP response header. The header value in seconds matches the 
retry_after field in the response body.
5xx Retry-After values
Code
retry_after (in seconds)
500
30
502
60
504
120
520
60
521
120
522
120
523
120
524
120
525
N/A (not retryable)
526
N/A (not retryable)
Non-retryable codes (525, 526) do not include the 
Retry-After header.
1xxx Retry-After values
Six retryable 1xxx error codes emit 
Retry-After:
Code
retry_after (in seconds)
Error name
1004
120
DNS resolution error
1015
30
Rate limited
1033
120
Argo Tunnel error
1038
60
HTTP headers limit exceeded
1200
60
Cache connection limit
1205
5
Too many redirects
All other 1xxx error codes are non-retryable and do not include the 
Retry-After header.
If a WAF rate limiting rule has already set a dynamic 
Retry-After value on the response, that value takes precedence over the default.
More resources
Cloudflare 1xxx errors
Cloudflare 5xx errors
Custom Errors
Connection limits
Markdown for Agents (content conversion)
RFC 9457 — Problem Details for HTTP APIs

Glossary
Review the definitions for terms used across Cloudflare's documentation.

Cloudflare and Google Analytics
Using Cloudflare does not affect Google Analytics (GA) tracking if it is added to the website in one of ways recommended by Google.
Standard GA setup
Cloudflare proxies traffic to your origin web server, but the GA JavaScript code never actually sends traffic to your server. Instead, it executes directly in a user's browser and does not interact with Cloudflare.
Cloudflare only affects analytics tools that read logs directly from your web server (like awstats).
:::note
To troubleshoot potential issues with Google Analytics, refer to Common GA setup mistakes.
:::
Zaraz
As an alternative to the standard setup of Google Analytics with tag/snippet, Cloudflare offers a way to use Google Analytics with Zaraz. Zaraz is a solution that allows Google Analytics to collect data without its script loaded on the website. If GA is set up this way, then not all features may be available.
:::note
Details about features of Google Analytics that are unavailable with Zaraz can be found in Zaraz FAQ
:::

Cloudflare HTTP headers
Request headers
Cloudflare passes all HTTP request headers to your origin web server and adds additional headers as specified below.
:::note
Cloudflare may remove HTTP request headers with names considered invalid according to NGINX — for example, header names containing a 
. (dot) character.
:::
Accept-Encoding
For incoming requests, the value of this header will always be set to 
accept-encoding: br, gzip. If the client set a different value, such as 
accept-encoding: deflate, it will be overwritten and the original value will be available in 
request.cf.clientAcceptEncoding.
CF-Connecting-IP
CF-Connecting-IP provides the client IP address connecting to Cloudflare to the origin web server.
This header will only be sent on the traffic from Cloudflare's edge to your origin web server.
For guidance on logging your visitor's original IP address, refer to Restoring original visitor IPs.
Alternatively, if you do not wish to receive the 
CF-Connecting-IP header or any HTTP header that may contain the visitor's IP address, enable the Remove visitor IP headers Managed Transform.
CF-Connecting-IP in Worker subrequests
In same-zone Worker subrequests, the value of 
CF-Connecting-IP reflects the value of 
x-real-ip (the client's IP). 
x-real-ip can be altered by the user in their Worker script.
In cross-zone subrequests from one Cloudflare zone to another Cloudflare zone, the 
CF-Connecting-IP value will be set to the Worker client IP address 
'2a06:98c0:3600::103' for security reasons.
For Worker subrequests destined for a non-Cloudflare customer zone, the Worker script controls the client IP headers: both 
CF-Connecting-IP and 
x-real-ip can be altered by the Worker. If the subrequest forwards the original request's headers unchanged, both headers reflect the client's IP address.
To authenticate that traffic originates from your own zone, use zone-level or per-hostname Authenticated Origin Pulls with your own certificate, or Cloudflare Tunnel.
When no Worker subrequest is triggered, 
cf-connecting-ip reflects the client's IP address and the 
x-real-ip header is stripped.
CF-Connecting-IPv6
Cloudflare provides free IPv6 support to all domains without requiring additional configuration or hardware. To support migrating to IPv6, Cloudflare's Pseudo IPv4 provides an IPv6 to IPv4 translation service for all Cloudflare domains.
 
CF-EW-Via
This header is used for loop detection, similar to the 
CDN-Loop header.
CF-Pseudo-IPv4
If Pseudo IPv4 is set to 
Add Header - Cloudflare automatically adds the 
CF-Pseudo-IPv4 header with a Class E IPv4 address hashed from the original IPv6 address.
True-Client-IP (Enterprise plan only)
True-Client-IP provides the original client IP address to the origin web server. 
True-Client-IP is only available on an Enterprise plan. In the example below, 
203.0.113.1 is the original visitor IP address. For example: 
True-Client-IP: 203.0.113.1
There is no difference between the 
True-Client-IP and 
CF-Connecting-IP headers besides the name of the header. Some Enterprise customers with legacy devices need 
True-Client-IP to avoid updating firewalls or load-balancers to read a custom header name.
To add a 
True-Client-IP HTTP header to requests, enable the Add "True-Client-IP" header Managed Transform.
Alternatively, if you do not wish to receive the 
True-Client-IP header or any HTTP header that may contain the visitor's IP address, enable the Remove visitor IP headers Managed Transform.
:::caution
If you are using Cloudflare in a stacked CDN and authenticating HTTP requests based on the IP address value in the 
True-Client-IP header, you must add a 
True-Client-IP header to your requests. If you do not add this header, its value can be spoofed to any value.
:::
X-Forwarded-For
X-Forwarded-For maintains proxy server and original visitor IP addresses. If there was no existing 
X-Forwarded-Forheader in the request sent to Cloudflare, 
X-Forwarded-For has an identical value to the 
CF-Connecting-IP header.
For example, if the original visitor IP address is 
203.0.113.1 and the request sent to Cloudflare does not contain an 
X-Forwarded-For header, then Cloudflare will send 
X-Forwarded-For: 203.0.113.1 to the origin.
If, on the other hand, an 
X-Forwarded-For header was already present in the request to Cloudflare, Cloudflare will append the IP address of the HTTP proxy connecting to Cloudflare to the header. For example, if the original visitor IP address is 
203.0.113.1 and a request is proxied through two proxies: proxy A with an IP address of 
198.51.100.101 and proxy B with an IP address of 
198.51.100.102 before being proxied to Cloudflare, then Cloudflare will send 
X-Forwarded-For: 203.0.113.1,198.51.100.101,198.51.100.102 to the origin. Proxy A will append the original visitor's IP address (
203.0.113.1) to 
X-Forwarded-For before proxying the request to proxy B which, in turn, will append Proxy A's IP address (
198.51.100.101) to 
X-Forwarded-For before proxying the request to Cloudflare. And finally, Cloudflare will append proxy B's IP address (
198.51.100.102) to 
X-Forwarded-For before proxying the request to the origin.
If you do not wish to receive the visitor's IP address (and other intermediate proxy IP addresses) in the 
X-Forwarded-For header, or any HTTP header that may contain the visitor's IP address, enable the Remove visitor IP headers Managed Transform. For the 
X-Forwarded-For header specifically, this Managed Transform will only remove the visitor IP from the header value when Cloudflare receives a request proxied by at least another CDN. In this case, Cloudflare will only keep the IP address of the last proxy.
Using the previous example where a request was proxied twice (proxies A and B) before being proxied through Cloudflare, with Remove visitor IP headers enabled, Cloudflare would send 
X-Forwarded-For: 198.51.100.102 to the origin, keeping only proxy B's IP address (the last proxy before Cloudflare). Refer to Visitor IP address in the 
x-forwarded-for HTTP header for more details.
:::note
To restore the original visitor IP address at your origin web server, Cloudflare recommends that your logs or applications look at 
CF-Connecting-IP or 
True-Client-IP instead of 
X-Forwarded-For. 
CF-Connecting-IP and 
True-Client-IP both have a consistent format containing only one IP address.
:::
X-Forwarded-Proto
X-Forwarded-Proto is used to identify the protocol (HTTP or HTTPS) that a visitor used to connect to Cloudflare. By default, the protocol used is 
https, unless the visitor selected a different encryption mode.
For incoming requests, the value of this header will be set to the protocol the client used (
http or 
https). If the client set a different value, it will be overwritten.
Cf-Ray
The 
Cf-Ray header (otherwise known as a Ray ID) is a hashed value that encodes information about the data center and the visitor's request. For example: 
Cf-Ray: 230b030023ae2822-SJC.
The Cf-Ray header identifies the data center processing the request when displayed as a response header. This is represented by a three-letter code corresponding to the data center's location.
The Cf-Ray header is also sent to upstream origins and may be modified to reflect the connecting data center. This occurs when a request is routed through Argo Smart Routing or Argo Tiered Caching. In such cases, the three-letter code in the Cf-Ray header will indicate the data center connecting to the origin, not the ingress data center.
Add the 
Cf-Ray header to your origin web server logs to match requests proxied to Cloudflare to requests in your server logs.
Enterprise customers can see all requests via Cloudflare Logs, including data related to the ingress data center.
CF-IPCountry
The 
CF-IPCountry header contains a two-character country code of the originating visitor's country.
Besides the ISO-3166-1 alpha-2 codes, Cloudflare uses the following special country codes:
XX - Used for clients without country code data.
T1 - Used for clients using the Tor network.
To add this header to requests, along with other HTTP headers with location information for the visitor's IP address, enable the Add visitor location headers Managed Transform.
:::note
The 
CF-IPCountry header is removed from requests made from a Worker to an origin that is not proxied behind Cloudflare.
:::
CF-Visitor
Currently, this header is a JSON object, containing only one key called 
scheme. The header will be either HTTP or HTTPS, and it is only relevant if you need to enable Flexible SSL in your Cloudflare settings. For example: 
CF-Visitor: { \"scheme\":\"https\"}.
CDN-Loop
CDN-Loop allows Cloudflare to specify how many times a request can enter Cloudflare's network before it is blocked as a looping request. For example: 
CDN-Loop: cloudflare.
CF-Connecting-O2O
If SSL for SaaS is used for the SaaS provider-owned zone, a HTTP header will be set to 
cf-connecting-o2o: 1.
CF-Worker
The 
CF-Worker request header is added to an edge Worker subrequest that identifies the host that spawned the subrequest. For example: 
CF-Worker: example.com.
You can add 
CF-Worker header on server logs similar to the way you add the 
CF-RAY header. To do that, add 
$http_cf_worker in the log format file: 
log_format cf_custom "CF-Worker:$http_cf_worker"'
CF-Worker is added to all Worker subrequests sent via 
fetch(). It is set to the name of the zone which owns the Worker making the subrequest. For example, a Worker script on route for 
foo.example.com/* from 
example.com will have all subrequests with the header:
CF-Worker: example.com
The intended purpose of this header is to provide a means for recipients (for example, origins, load balancers, other Workers) to recognize, filter, and route traffic generated by Workers on specific zones.
:::note
When configuring WAF custom rules, do not match on this header. These rules are applied before Cloudflare adds the 
CF-Worker header. Instead, use the 
cf.worker.upstream_zone field, which contains the same value and exists for the same purpose.
To block a specific Worker, add a 
Block action triggered by the expression 
cf.worker.upstream_zone eq "example.com".
To block all Worker subrequests except those from your own zone's Worker, add a 
Block action triggered by the expression 
not (cf.worker.upstream_zone in {"" "customer-zone.com"}).
:::
Connection
For incoming requests, the value of this header will always be set to 
Keep-Alive. If the client set a different value, such as 
close, it will be overwritten. Note that is also the case when the client uses HTTP/2 or HTTP/3 to connect.
Considerations for Spectrum
When using Spectrum with a TCP application, these headers are not visible at the origin as they are HTTP headers. If you wish to utilize these in your application, there are two options:
Use an HTTP or HTTPS Spectrum app instead of TCP
Use the Proxy Protocol feature
Response headers
Cloudflare will remove some HTTP headers from the response sent back to the visitor and add some Cloudflare-specific HTTP headers.
Removed response headers
Cloudflare passes all HTTP headers in the response from the origin server back to the visitor with the exception of the following headers:
X-Accel-Buffering
X-Accel-Charset
X-Accel-Limit-Rate
X-Accel-Redirect
Alt-Svc
Cache-Tag — Removed before the response is sent to the visitor or passed to a Worker. Refer to Purge by cache-tags.
Added response headers
Cloudflare adds the HTTP headers specified below to the response sent to the visitor.
Cf-Ray
The 
Cf-Ray value returned to the visitor will be the same 
Cf-Ray value that was sent to the origin server.
Cf-Cache-Status
A list of all possible 
Cf-Cache-Status values is contained in Cloudflare cache responses.

Reference


Markdown for Agents
What is Markdown for Agents
Markdown has quickly become the lingua franca for agents and AI systems as a whole. The format’s explicit structure makes it ideal for AI processing, ultimately resulting in better results while minimizing token waste.
Cloudflare's network supports real-time content conversion at the source, for enabled zones using content negotiation headers. When AI systems request pages from any website that uses Cloudflare and has Markdown for Agents enabled, they can express the preference for 
text/markdown in the request and our network will automatically and efficiently convert the HTML to Markdown, when possible, on the fly.
Read the announcement in our blog for more information.
How to use
To fetch the Markdown version of any page from a zone with Markdown for Agents enabled, the client needs to add the 
Accept negotiation header with 
text/markdown as one of the options. Cloudflare will detect this, fetch the original HTML version from the origin, and convert it to Markdown before serving it to the client.
Here's a curl example with the 
Accept negotiation header requesting this page from our developer documentation:
curl https://developers.cloudflare.com/fundamentals/reference/markdown-for-agents/ \
  -H "Accept: text/markdown"
Or if you’re building an AI Agent using Workers, you can use TypeScript:
const r = await fetch(
	`https://developers.cloudflare.com/fundamentals/reference/markdown-for-agents/`,
	{
		headers: {
			Accept: "text/markdown",
		},
	},
);
const markdown = await r.text();
The response to this request is now formatting in markdown:
HTTP/2 200
date: Wed, 11 Feb 2026 11:44:48 GMT
content-type: text/markdown; charset=utf-8
vary: accept
cache-control: public, max-age=3600
strict-transport-security: max-age=63072000; includeSubDomains
content-signal: ai-train=yes, search=yes, ai-input=yes
---
title: Markdown for Agents · Cloudflare Agents docs
---
## What is Markdown for Agents
Markdown has quickly become the lingua franca for agents and AI systems
as a whole. The format’s explicit structure makes it ideal for AI processing,
ultimately resulting in better results while minimizing token waste.
...
Response headers
Markdown for Agents preserves the headers from your origin response on the converted response, so security- and cache-relevant headers survive conversion. This includes headers such as 
Strict-Transport-Security (HSTS), 
Content-Security-Policy (CSP), 
X-Frame-Options, 
Set-Cookie, CORS headers (for example, 
Access-Control-Allow-Origin), and caching headers (
Cache-Control, 
Expires, 
Age).
Because the body is replaced with converted Markdown, the following changes are applied:
Content-Type is set to 
text/markdown; charset=utf-8.
Vary includes 
Accept (any 
Vary dimensions your origin already declared are preserved) so that caches store separate variants for Markdown and HTML.
Content-Length is removed because the Markdown response is streamed.
Headers that describe the original body are removed, because they no longer match the converted response: 
Content-Encoding, 
Content-Range, 
Transfer-Encoding, 
ETag, and 
Last-Modified. 
ETag and 
Last-Modified are dropped because conditional requests (
If-None-Match, 
If-Modified-Since) cannot be honored for converted responses.
Content Signals Policy
Content Signals is a framework that allows anyone to express their preferences for how their content can be used after it has been accessed.
If your origin already sets a 
content-signal header, Markdown for Agents preserves that value on the converted response — your origin's policy is authoritative. This lets you define custom Content Signal policies by setting the 
content-signal header at your origin.
When the origin response does not include a 
content-signal header, Markdown for Agents adds a default 
Content-Signal: ai-train=yes, search=yes, ai-input=yes, signaling that the content can be used for AI Training, Search results, and AI Input, which includes agentic use.
Output format
Markdown for Agents returns a Markdown document with a consistent, predictable structure so AI systems can rely on it without per-site parsing logic. The response always follows this layout:
YAML frontmatter with metadata extracted from the page's 
<meta> tags. Only emitted when at least one supported meta tag is present.
Body Markdown converted from the document body. Non-content elements (such as headers, footers, navigation, scripts, and styles) are stripped during pre-processing. For the full list of elements that are removed, refer to HTML pre-processing in the Workers AI Markdown Conversion documentation.
JSON-LD structured data preserved as a fenced 
json code block at the end of the document. Only emitted when the source HTML contains JSON-LD.
YAML frontmatter
When the source HTML contains supported 
<meta> tags, Markdown for Agents prepends a YAML frontmatter block to the response. The block uses the following fields:
Field
Source 
<meta> tag
title
<meta name="title">, with fallback to 
<meta property="og:title">
description
<meta name="description">, with fallback to 
<meta property="og:description">
image
<meta property="og:image">
Only fields with a value are emitted. If the source HTML does not contain any of the supported meta tags, the frontmatter block is omitted entirely.
For 
title and 
description, the standard 
<meta name="..."> form always takes priority over the Open Graph 
<meta property="og:..."> form, regardless of the order they appear in the HTML. Open Graph values are used only as fallbacks when the standard form is missing.
Example output:
---
title: My Page Title
description: A short summary of the page.
image: https://example.com/cover.png
---
# Page heading
...
JSON-LD
JSON-LD is a structured-data format used by search engines and AI systems to interpret a page's semantic content. Markdown for Agents preserves any 
<script type="application/ld+json"> blocks from the source HTML by appending them at the end of the converted Markdown inside a single fenced 
json code block.
If the source HTML contains multiple JSON-LD scripts, all of them are concatenated within the same code block, each on its own line.
JSON-LD is the only 
<script> content preserved in the output — all other 
<script> and 
<style> content is stripped during HTML pre-processing.
Example output:
... main markdown content ...
```json
{
	"@context": "https://schema.org",
	"@type": "Article",
	"headline": "Article Title",
	"author": { "@type": "Person", "name": "Jane Doe" }
}
```
How to enable
Availability and Pricing
Markdown for Agents is available to Pro, Business and Enterprise plans, and SSL for SaaS customers at no cost.
Try it with Cloudflare
We have enabled this feature in our Developer Documentation and our Blog, inviting all AI crawlers and agents to consume our content using markdown instead of HTML.
curl https://blog.cloudflare.com/markdown-for-agents/ \
  -H "Accept: text/markdown"
Limitations
We only convert from HTML, other types of documents may be included in the future.
Conversion is limited to 6 MiB (6,291,456 bytes) of decompressed HTML. The limit applies after decompression, not to the compressed response size.
Other Markdown conversion APIs
If you’re building AI systems that require arbitrary document conversion from outside Cloudflare or Markdown for Agents is not available from the content source, we provide other ways to convert documents to Markdown for your applications:
Workers AI AI.toMarkdown() supports multiple document types and summarization.
The Browser Run /markdown endpoint supports markdown conversion if you need to render a dynamic page or application in a real browser before converting it.

Network Layers
Below is a list of the different layers that makes up the open systems interconnection (OSI) model and the associated Cloudflare products.
:::note
The list of related products is representative but not comprehensive.
:::
Network layer
Protocol and related products
7 Application layer
HTTP, DNS
 Authoritative DNS, Bot Management, CDN, Cloudflare Access, Cloudflare Gateway (outbound only), Cloudflare Tunnel, Load Balancing, Stream, WAF
6 Presentation layer
5 Session layer
4 Transport layer
TCP/UDP
 Argo Smart Routing, Cloudflare Gateway (outbound only), Load Balancing, Spectrum
3 Network layer
IP, GRE, any packet/protocol
 Cloudflare Network Firewall, Magic Transit, Cloudflare WAN
2 Datalink layer
Direct connection
 Cloudflare Network Interconnect (CNI)
1 Physical layer
Direct connection
 Cloudflare Network Interconnect (CNI)

Network ports
Learn which network ports Cloudflare proxies by default and how to enable Cloudflare's proxy for additional ports.
Network ports compatible with Cloudflare's proxy
By default, Cloudflare proxies traffic destined for the HTTP/HTTPS ports listed below.
HTTP ports supported by Cloudflare
80
8080
8880
2052
2082
2086
2095
HTTPS ports supported by Cloudflare
443
2053
2083
2087
2096
8443
Ports supported by Cloudflare, but with caching disabled
2052
2053
2082
2083
2086
2087
2095
2096
8880
8443
:::note
Enterprise customers that want to enable caching on these ports can do so by creating a cache rule.
:::
How to enable Cloudflare's proxy for additional ports
If traffic for your domain is destined for a different port than the ones listed above, for example you have an SSH server that listens for incoming connections on port 22, either:
Change your subdomain to be gray-clouded, via your Cloudflare DNS app, to bypass the Cloudflare network and connect directly to your origin.
Configure a Spectrum application for the hostname running the server. Spectrum supports all ports. Spectrum for all TCP and UDP ports is only available on the Enterprise plan. If you would like to know more about Cloudflare plans, please reach out to your Cloudflare account team.
How to block traffic on additional ports
Block traffic on ports other than 80 and 443 in Cloudflare paid plans by doing one of the following:
If you are using WAF managed rules (previous version), enable rule ID 
100015 (
Anomaly:Port - Non Standard Port (not 80 or 443)).
If you are using the new Cloudflare Web Application Firewall (WAF), enable rule ID 
8e361ee4328f4a3caf6caf3e664ed6fe (
Anomaly:Port - Non Standard Port (not 80 or 443)), which is disabled by default. This rule is part of the Cloudflare Managed Ruleset.
Ports 80 and 443 are the only ports compatible with:
HTTP/HTTPS traffic within China data centers for domains that have the China Network enabled
 
The WAF's Cloudflare Managed Ruleset includes a rule that will block traffic at the application layer (layer 7 in the OSI model), preventing HTTP/HTTPS requests over non-standard ports from reaching the origin server.
:::note
Cloudflare Access does not support port numbers in URLs. Port numbers are stripped from requests for URLs protected through Cloudflare Access.
:::
Related resources
Managing DNS records at Cloudflare

Partners
Cloudflare Technology Partners offer purpose-built integrations with our products, providing expanded functionality for our users. Learn how to configure these integrations with our tutorials and how-to guides.
Analytics integrations
Learn how to configure a variety of products with Cloudflare Analytics:
Cloudflare Network Interconnect
Connect your network infrastructure with Cloudflare network connectivity partners for increased reliability and security.
Cloudflare Zero Trust Technology Partners
Our third-party integrations allow you to deploy the Cloudflare One Client application and configure devices remotely.
Cloudflare Logs
Enterprise customers have access to detailed logs of the metadata generated by our products, and logs from Cloudflare solutions can be pushed to a variety of log management providers and storage services.
Cloudflare Technology Partners for Cloudflare WAN
Cloudflare WAN (formerly Magic WAN) integrates with a number of third-party partners, which enables our users to securely route their Internet traffic.

Redirects
Cloudflare offers a variety of ways to perform URL redirects, which tell a visitor's browser that the location of a page has been changed.
Use the following table to determine when to use each option.
Option
Use when
Single redirects
As a default option.
Bulk redirects
When you have a large number of static redirects.
Pages redirects
If you have a Pages project.
Workers redirect
When the other redirects do not meet your needs.
Page Rules
If you already rely on Page Rules for other requirements.

Scans and penetration testing policy
Customers may conduct scans and penetration tests (with certain restrictions) on application and network-layer aspects of their own assets, such as their zones within their Cloudflare accounts, provided they adhere to Cloudflare's policy.
Permitted targets
All scans or testing must be limited to the following:
Customer-owned IPs
Cloudflare's designated public IPs
The customer's registered DNS entries
Targets like 
*.cloudflare.com or other Cloudflare-owned destinations are only allowed as part of Cloudflare's Public Bug Bounty program. Refer to the Additional resources section for more information.
Scans
Throttling: Scans should be throttled to a reasonable rate to prevent disruptions and ensure stable system performance.
Scope and intent: Scans should identify the presence of vulnerabilities without attempting to actively exploit any detected weaknesses.
Exclusions: It is recommended to exclude 
/cdn-cgi/ endpoints from scans to avoid false positives or irrelevant results.
Compliance checks: Customers may conduct PCI compliance scans or verify that known vulnerabilities have been addressed.
Penetration tests
Before starting a penetration test on your zones, set the following application security configurations for each zone you will run the test on:
Deploy the Cloudflare Managed Ruleset and
enable all rules in the ruleset by setting Ruleset status to Enabled.
Deploy the Cloudflare OWASP Core Ruleset and set the following ruleset configuration:
Paranoia Level: PL4
Score threshold: High - 25 and higher
Create a custom rule based on the WAF attack score to block requests considered as an attack (WAF attack score between 1 and 20). Refer to the WAF attack score documentation for an example.
Create a custom rule based on malicious uploads detection to block requests containing content objects considered malicious. Refer to Example rules for examples of custom rules used to mitigate this kind of threat.
On Pro and Business plans without Bot Management, enable Super Bot Fight Mode.
Customers with access to Bot Management should make sure that Bot Management is enabled (it is enabled by default on entitled zones).
Create rate limiting rules to protect key endpoints of the zone being tested. Refer to Rate limiting rule examples and Rate limiting best practices for example configurations.
Be aware that other Cloudflare security and performance features, configurations, and rules active on your account or zone can influence test results.
After completing the test, it is recommended that you review your security posture and make any necessary adjustments based on the findings.
Important remarks
Cloudflare's anycast network will report ports other than 
80 and 
443 as open due to its shared infrastructure and the nature of Cloudflare's proxy. The reporting is expected behavior and does not indicate a vulnerability.
Tools like Netcat may list non-standard HTTP ports as open; however, these ports are open solely for Cloudflare's routing purposes and do not necessarily indicate that a connection can be established with the customer's origin over those ports.
Known false positives: Any findings related to the ROBOT vulnerability are false positives when the customer's assets are behind Cloudflare.
Denial-of-Service (DoS) tests
For guidelines on required notification and necessary information, refer to Simulating test DDoS attacks. Customers should also familiarize themselves with Cloudflare's DDoS protection best practices.
Additional resources
Customers can download the latest Penetration Test Report of Cloudflare via the dashboard.
For information about Cloudflare's Public Bug Bounty program, visit HackerOne.

SDK ecosystem support policy
Unless otherwise stated in the code repository, Cloudflare only provides active support for the latest major version of a library or tool. The exception to this policy is for critical security fixes, which will be reviewed on a case-by-case basis and take the vulnerability, impact, and mitigation required into consideration.
We provide three primary stages of development: early access, active support, and end of life.
:::note
These lifecycle stages may be referred to in different terms across Cloudflare products, but the underlying principles are the same.
:::
Early access
During this stage, Cloudflare makes SDK changes available that we are seeking feedback on prior to releasing for general usage. Early access will  often include warning labels or caveats on functionality that is subject to change without notice. In general, early access SDKs are not suitable for production systems unless explicitly mentioned.
Active support
During the active support stage, planned changes and support are offered for the library or tool.
End of life
During the end of life stage, a new major version of the library or tool is released and Cloudflare marks the previous major version as no longer receiving improvements or bug fixes. If you continue to run end of life versions, support will be very limited.
Previous or end of life versions
While Cloudflare cannot provide support for all older versions of our libraries or tools, we do not remove those versions so they can continued to be used without direct support.
Versioning
The SDK ecosystem follows semantic versioning, which defines versions as follows:
MAJOR version when there are backward-incompatible changes made.
MINOR version when functionality is added in a backward compatible-manner.
PATCH version for backward-compatible bug fixes (without any improvements).
:::caution
As Cloudflare has recently swapped to automatically generating our libraries using OpenAPI, we have relaxed the strict versioning requirements on the libraries (Terraform is not changing). Minor releases may contain breaking changes in the forms of method, structure, or type renames as the service owners stabilize their schemas and iterate on usability improvements.
If this is not suitable for your use case, pin to a known good version or use the previous major version of the library.
:::
Depending on your needs, you should ensure your application's package manager versioning is configured correctly. At a minimum, restrict installation to the current major version of the library or tool you are using to prevent any major version upgrades occurring automatically.
Migration
Where possible, Cloudflare provides an automated approach to performing major version upgrades to limit the disruption using codemods. Review the library or tool-specific release notes for how to use these migration tools.
Alongside the automatic migration approach, we provide documentation on the changes that have taken place in case you need to make the changes manually.
Related resources
Semantic versioning definitions
Cloudflare's Terraform documentation

TCP connections
The following section explains how Cloudflare directs traffic efficiently with anycast routing and serves as an intermediary between users and origin servers. The second part covers TCP connections and keep-alives for performance optimization, and lastly, TCP Fast Open (TFO), a protocol extension that enhances the speed of TCP connections.
How Cloudflare connects user to origin
Users connect to Cloudflare by sending requests from their devices to Cloudflare's global network. Cloudflare connects to the origin server by acting as an intermediary between the user and the origin.
flowchart LR
accTitle: Connections with Cloudflare
A[Visitor] <-- Connection --> B[Cloudflare global network] <-- Connection --> C[Origin server]
User traffic is routed to the nearest Cloudflare data center based on the shortest Border Gateway Protocol (BGP) path, thanks to anycast routing. Cloudflare then processes the request. In case a request is not served from Cloudflare’s data centers, Cloudflare will open a connection to the origin server to forward the request.
TCP connections and keep-alives
HTTP (Hypertext Transfer Protocol) is a Layer 7 application protocol that operates over TCP. By default, HTTP opens a new TCP connection for each request-response cycle, which can lead to performance overhead due to the repeated connection establishment and teardown.
Keep-Alives are a mechanism that bridges TCP and HTTP, and allow a single TCP connection to remain open for multiple HTTP requests and responses. This minimizes the connection overhead and latency associated with establishing new TCP connections for each web resource. Keep-Alives improve the efficiency and responsiveness of web applications by facilitating the reuse of existing connections, reducing network traffic, and enhancing user experience.
TCP connections can persist even after HTTP requests have concluded. However, to manage resources efficiently, idle connections are typically terminated after a certain period of inactivity. To enhance connection reuse and minimize connection overhead, keep-alives are employed. These mechanisms collectively optimize the performance and reliability of web applications while conserving network resources.
If either a user or an origin does not respond to two keep-alives, Cloudflare will sever the connection by sending a TCP Reset (RST) packet.
For connections to users, Cloudflare has a default idle timeout of 400 seconds. After the 400 seconds, Cloudflare will start sending keep-alive probes every 75 seconds. If nine consecutive probes are unanswered, Cloudflare will sever the connection by sending an RST packet.
:::note
Be aware that even if there are keep-alives, Cloudflare cannot guarantee to keep a connection, since besides idleness, there are other reasons, like capacity balancing, data center maintenance or node restarts that can cause disconnections. Having this in mind, applications should be structured to handle disconnections gracefully.
:::
TCP connection settings between the user and Cloudflare, and between Cloudflare and Origin can be customized for Enterprise customers. Reach out to your account team for more details.
TCP Fast Open (TFO)
TCP Fast Open (TFO) is a protocol extension that can significantly improve the speed of establishing TCP connections by allowing data to be sent in the initial SYN packet, rather than requiring a separate handshake before data transmission begins. TFO can reduce latency and improve website and application performance, particularly on high-latency networks. Cloudflare supports TFO on user connections.
When a client initiates a connection to a web server protected by Cloudflare, it sends a TCP SYN packet to request a connection. Cloudflare, acting as a reverse proxy, intercepts the SYN packet and responds with a SYN-ACK packet to establish the connection. With TFO enabled, Cloudflare can also send initial data (such as HTTP request data) in the SYN-ACK packet, eliminating the need for an additional round-trip for data transmission. The client receives the SYN-ACK packet with data and acknowledges it with an ACK packet. This fast tracks the connection setup.

Troubleshooting
When you set up Cloudflare, you may experience the following issues or error messages.
Error messages
ERR_TOO_MANY_REDIRECTS
525 or 
526 errors
Cannot add DNS records with the same name
ERR_SSL_VERSION_OR_CIPHER_MISMATCH or 
SSL_ERROR_NO_CYPHER_OVERLAP
DNS_PROBE_FINISHED_NXDOMAIN
Record exposing origin server IP address
Mixed content errors
SSL errors in appear in my browser
Behavior
Why are Cloudflare's IPs in my origin web server logs?
Is Cloudflare attacking me?
Cannot add domain to Cloudflare
My domain’s email stopped working
Why is my site served over HTTP instead of HTTPS?
SSL is not working for my second-level subdomain, such as 
dev.www.example.com
Why was my domain deleted from Cloudflare?
Cloudflare
Gather information to troubleshoot site issues
Contact Cloudflare support
Manage email notifications
General resources
DNS FAQ
SSL/TLS FAQ
Is Cloudflare attacking me
Two common scenarios falsely lead to the perception that Cloudflare is attacking your site:
Unless you restore the original visitor IP addresses, Cloudflare IP addresses appear in your server logs for all proxied requests.
The attacker is spoofing Cloudflare's IPs. Cloudflare only sends traffic to your origin web server over a few specific ports unless you use Cloudflare Spectrum.
Ideally, because Cloudflare is a reverse proxy, your hosting provider observes attack traffic connecting from Cloudflare IP addresses. In contrast, if you notice connections from IP addresses that do not belong to Cloudflare, the attack is direct to your origin web server. Cloudflare cannot stop attacks directly to your origin IP address because the traffic bypasses Cloudflare's network.
:::note
If an attacker is directly targeting your origin web server, refer to Proactive DDoS defense best practices.
:::

Under Attack mode
Cloudflare's Under Attack mode performs additional security checks to help mitigate layer 7 DDoS attacks. Validated users access your website and suspicious traffic is blocked. It is designed to be used as one of the last resorts when a zone is under attack (and will temporarily pause access to your site and impact your site analytics).
When enabled, visitors receive an interstitial page.
Turn on Under Attack mode
Under Attack mode is turned off by default for your zone.
Globally
To put your entire zone in Under Attack mode:
In the Cloudflare dashboard, select your account and zone from the Account home page.
https://dash.cloudflare.com/?to=/:account/home
In the zone overview page, turn on Under Attack Mode in the Quick Actions sidebar.
Selectively
To enable Under Attack mode for specific pages or sections of your site, use a configuration rule to adjust the Security Level.
When incoming requests match
Field: URI Path
Operator: starts with
Value: 
/admin
If you are using the Expression Editor, enter the following expression:
(starts_with(http.request.uri.path, "/admin"))
Then the settings are
For I'm Under Attack, select Add.
Switch the toggle to On.
To turn it on for specific ASNs (hosts/ISPs that own IP addresses), countries, or IP ranges, use IP Access Rules.
Preview Under Attack mode
To preview what Under Attack mode looks like for your visitors:
In the Cloudflare dashboard, go to the Configurations page.
https://dash.cloudflare.com/?to=/:account/configurations
Go to Custom Pages.
For Managed Challenge / I'm Under Attack Mode™, select Custom Pages > View default.
The 
Checking your browser before accessing... challenge determines whether to block or allow a visitor within five seconds. After passing the challenge, the visitor does not observe another challenge until the duration configured in Challenge Passage.
Potential issues
Since the Under Attack mode requires your browser to support JavaScript to display and pass the interstitial page, it is expected to observe impact on third party analytics tools.

Migration guides


SCIM v1 to v2 Migration
Cloudflare's first iteration of SCIM integration introduced a concept called Virtual Groups, typically identified by the pattern 
CF-<accountID>-<Role Name> in your IdP. Virtual Groups were an early implementation of group-based access control: they acted as placeholders created automatically by SCIM to map IdP groups to account memberships.
While customers could add or remove members from these groups within their IdP, Virtual Groups had important limitations:
They could not be renamed or deleted in the IdP.
They could not be managed within Cloudflare.
Functionally, managing a Virtual Group was equivalent to syncing users and editing each member’s policies individually.
With the GA of User Groups, Virtual Groups are now deprecated. Customers should migrate to User Groups, which provide a more flexible and scalable way to assign and manage policies. To maintain SCIM synchronization with the Cloudflare Dashboard, we strongly recommend migrating to SCIM User Groups.
If you have never synced a group linked to a 
CF-<accountID>-<Role Name> Virtual Group from your IdP to Cloudflare, no action is needed.
Migration steps
Create a new SCIM integration in your IdP using an Account Owned Token provisioned in Cloudflare.
Assign users & groups to your new Application in your IdP, following a naming convention that aligns with your internal processes.
Sync groups to Cloudflare and verify they appear in the User Groups pane of the Cloudflare Dashboard.
Attach permission policies to the new User Groups so members inherit the correct access upon assignment to the group.
Migrate users into the new groups incrementally, testing synchronization of users & groups into the Cloudflare Dashboard.
Clean up legacy resources by removing SCIM v1 Virtual Groups and IdP mappings that follow the 
CF-<accountID>-<Role Name> pattern.
More resources
User Groups changelog
User Groups documentation
Create an Account Owned Token
SCIM provisioning setup guide

Cloudflare Cookies
Cloudflare uses various cookies to maximize network resources, manage traffic, and protect our customers’ sites from malicious traffic.
Understanding the Cloudflare Cookies
As defined in our Privacy Policy, all the cookies listed below are strictly necessary to provide the services requested by our customers, unless otherwise stated.
As mentioned in our Privacy Policy, Cloudflare encourages our customers to disclose the use of these cookies to their end users. In some jurisdictions, customers may be required by law to disclose these cookies to their end users.
By default, cookie data may be processed in Cloudflare's data center in the United States and is subject to the cross-border data transfer section 7 of the Cloudflare Privacy Policy. Customers who use the Data Localization Suite can control where cookie data is processed (with Regional Services) and logged (using the Customer Metadata Boundary).
__cflb cookie for Cloudflare Load Balancer session affinity
When enabling session affinity with Cloudflare Load Balancer, Cloudflare sets a 
__cflb cookie with a unique value on the first response to the requesting client. Cloudflare routes future requests to the same origin, optimizing network resource usage. In the event of a failover, Cloudflare sets a new 
__cflb cookie to direct future requests to the failover pool.
The 
__cflb cookie allows Cloudflare to return an end user to the same customer origin for a specific period of time configured by the customer. This allows the end user to have a seamless experience (for example, this cookie is used for keeping an end user’s items in a shopping cart while they continue to navigate around the website). This cookie is a session cookie that lasts from several seconds up to 24 hours.
:::note
Currently Cloudflare only supports Session Affinity in "orange-cloud" (proxied) mode.
:::
__cf_bm cookie for Cloudflare bot products
Cloudflare's bot products identify and mitigate automated traffic to protect your site from bad bots. Cloudflare places the 
__cf_bm cookie on end-user devices that access customer sites protected by Bot Management or Bot Fight Mode. The 
__cf_bm cookie is necessary for these bot solutions to function properly.
This cookie expires after 30 minutes of continuous inactivity by the end user. The cookie contains information related to the calculation of Cloudflare's proprietary bot score and, when Anomaly Detection is enabled on Bot Management, a session identifier. The information in the cookie (other than time-related information) is encrypted and can only be decrypted by Cloudflare.
:::note
The 
Set-Cookie header attributes for the 
__cf_bm cookie may use different casing depending on infrastructure version. For example, the expiration attribute may appear as 
expires or 
Expires. If you parse cookie headers programmatically, use case-insensitive matching for attribute names.
:::
A separate 
__cf_bm cookie is generated for each site that an end user visits, as Cloudflare does not track users from site to site or from session to session. The 
__cf_bm cookie is generated independently by Cloudflare, and does not correspond to any user ID or other identifiers in a customer's web application.
:::note
Bot Management is available to Enterprise customers as an add-on service. Contact your Cloudflare account team to enable Bot Management for your site. Non-Enterprise customers can enable Bot Fight Mode or Super Bot Fight Mode.
:::
__cfseq cookie for Cloudflare bot products
cf_clearance cookie for Cloudflare bot products
The 
cf_clearance cookie is required for JavaScript detections. JavaScript detections are stored in the 
cf_clearance cookie.
The 
cf_clearance cookie is set with 
SameSite=None; Secure; Partitioned so that challenge state is preserved across cross-site requests while complying with CHIPS ↗. When the cookie is issued inside a third-party context, it is stored in a partition keyed to the top-level site and is not shared across embedding sites. For details, refer to Partitioned cookies (CHIPS) and 
cf_clearance.
cf_ob_info and cf_use_ob cookie for Cloudflare Always Online
The 
cf_ob_info cookie provides information on:
The HTTP Status Code returned by the origin web server
The Ray ID of the original failed request
The data center serving the traffic
The 
cf_use_ob cookie informs Cloudflare to fetch the requested resource from the Always Online cache on the designated port. Applicable values are: 0, 80, and 443. The 
cf_ob_info and 
cf_use_ob cookies are persistent cookies that expire after 30 seconds.
__cfwaitingroom for Cloudflare Waiting Room
Cloudflare's Waiting Room product enables a waiting room for a particular host and path combination within a zone. Visitors are put in the waiting room and provided an estimate of when they will be allowed to access the application, if not immediately available.
The 
__cfwaitingroom cookie is only used to track visitors that access a waiting room enabled host and path combination for a zone. Visitors using a browser that does not accept cookies cannot visit the host and path combination while the waiting room is active. For more details, refer to Waiting Room cookies.
__cfruid to support Cloudflare Rate Limiting (previous version)
The 
__cfruid cookie is strictly necessary to support Cloudflare Rate Limiting products. As part of our Rate Limiting solution, this cookie is required to manage incoming traffic and to have better visibility on the origin of a particular request.
_cfuvid for Rate Limiting Rules
The Rate Limiting Rules product uses a number of techniques for applying rate limits to traffic where multiple unique visitors share the same IP address, such as traffic from behind a NAT. These techniques can be enabled by using the 
cf.unique_visitor_id field in the rate limiting configuration.
The 
_cfuvid cookie is only set when a site uses this option in a Rate Limiting Rule, and is only used to allow the Cloudflare WAF to distinguish individual users who share the same IP address. Visitors who do not provide the cookie are likely to be grouped together and may not be able to access the site if there are many other visitors from the same IP address.
Additional cookies used by the Challenge Platform
The table below shows additional cookies used by the Challenge Platform.
Cookie Name
Description
cf_clearance
Clearance Cookie stores the proof of challenge passed. It is used to no longer issue a challenge if present. It is required to reach an origin server.
cf_chl_rc_i; 
cf_chl_rc_ni; 
cf_chl_rc_m
These cookies are for internal use which allows Cloudflare to identify production issues on clients.
:::caution
If your website is not using HTTPS, you may experience issues with the 
cf_clearance cookie.
:::
Cloudflare Access cookies
To review Cloudflare Access cookies and their behavior, refer to Access cookies.

Compliance documentation
Super Administrators can access common compliance documentation, such as PCI, SOC 2, ISO, and more, through the Cloudflare dashboard.
To access compliance documentation:
Visit Compliance Documents and select your account where you are a Super Administrator.
If you have not accessed this page before, read the confidentiality statement and select I Agree.
Choose the document you need and select Download.
:::note
For confidentiality purposes, only Super Administrators for an account can access compliance documentation.
:::
Public data protection and compliance documentation
Information and documents about Cloudflare's privacy & data protection are available at the Cloudflare Trust Hub.
Tax documentation
Super Administrators, Billing Administrators, and Administrators can access tax documentation, such W-9 and Tax Certificates, through the Cloudflare dashboard.
To access tax documentation:
Visit Tax Documents and select your account where you are a Super Administrator, Billing Administrator or Administrator.
Choose the document you need and select Download.

Content Security Policies (CSPs)
A Content Security Policy (CSP) is an added layer of security that helps detect and mitigate certain types of attacks, including:
Content/code injection
Cross-site scripting (XSS)
Embedding malicious resources
Malicious iframes (clickjacking)
To learn more about configuring a CSP in general, refer to the Mozilla documentation.
Using a CSP with Cloudflare
Cloudflare's CDN is compatible with CSP.
Cloudflare does not:
Modify CSP headers from the origin web server (except when using Zaraz, to ensure the Zaraz script is always running).
Require changes to acceptable sources for first or third-party content.
Modify URLs (besides adding the 
/cdn-cgi/ endpoint and Cloudflare Fonts that rewrites Google Fonts urls).
Interfere with locations specified in your CSP.
If you require the CSP headers to be changed or added, you can change them using some Cloudflare products:
If your website is proxied through Cloudflare, you can use a response header transform rule to replace or add CSP headers.
If your website is hosted using Cloudflare Pages, you can set a 
_headers file to modify or add CSP headers.
Product requirements
To use certain Cloudflare features, however, you may need to update the headers in your CSP:
Feature(s)
Updated headers
Rocket Loader
script-src 'self' ajax.cloudflare.com;
Scrape Shield
script-src 'self' 'unsafe-inline'
Web Analytics
script-src static.cloudflareinsights.com; connect-src cloudflareinsights.com
Bot products
Refer to JavaScript detections and CSPs.
Client-side security (formerly Page Shield)
Refer to CSP header format.
Zaraz
No updates required (details).
Turnstile
Refer to Turnstile CSP.

Project Cybersafe Schools
Project Cybersafe Schools grants eligible schools with free access to Cloudflare's Email security and Gateway products.
School Eligibility
Children’s Internet Protection Act (CIPA)
CIPA Requirements
Configuration
Onboarding Guide
For a comprehensive guide, refer to the Project Cybersafe Schools Learning Path, which takes you step by step through the technical concepts, creating an account, onboarding your traffic, and enabling the CIPA filters.

Delivering Videos with Cloudflare
Cloudflare launched in 2010 believing everyone deserves a secure, fast, reliable web presence. We did not think you should have to pay more when you came under cyber attack, so we offered free and fixed-rate pricing for websites. That worked because most websites do not consume much bandwidth, and so we could provide our services in an affordable way to everyone. From the beginning, we prohibited streaming video content using our bandwidth. While you could embed a video from another provider, we limited your ability to use our services to deliver video bits from our network to your visitors. This restriction exists because every second of a typical video requires as much bandwidth as loading a full web page.
Over time we recognized that some of our customers wanted to stream video using our network. To accommodate them, we developed our Stream product. Stream delivers great performance at an affordable rate charged based on how much load you place on our network.
Unfortunately, while most people respect these limitations and understand they exist to ensure high quality of service for all Cloudflare customers, some users attempt to misconfigure our service to stream video in violation of our service-specific terms. We want to make sure our service is great for everyone, including public service initiatives we run like Project Galileo, The Athenian Project, and Project Fair Shot. A handful of people misusing our service limits our ability to run these initiatives.
The following are some recommendations for using Cloudflare's services based on what may have brought you to this page.
:::note[Cloudflare Tunnel]
Cloudflare Tunnel public hostname routes proxy traffic through Cloudflare. On Free, Pro, and Business plans, this traffic is subject to the terms described on this page.
The restriction does not apply to private network routes. Refer to Private networks to route large-file or high-traffic workloads privately.
:::
I'm a website operator and my content was redirected for Terms of Service violations
If you are on a Free, Pro, or Business Plan and your application appears to be serving videos or a disproportionate amount of large files without using the appropriate paid service as described below, Cloudflare may redirect your content or take other actions to protect quality of service. When this happens, you will receive an email notification regarding Cloudflare's actions and your options.
Options for web admins to remove redirects
Serve redirected content from a grey-clouded sub-domain
Serve redirected content from a paid service as outlined below
Delivering videos with Cloudflare using paid products
Cloudflare permits the delivery of video content with specific paid services. If you are interested in serving video content, there are two recommended options.
Option 1: Cloudflare Stream
Stream is a video-on-demand platform for building video applications. Stream encodes, stores, and delivers optimized video formatted for different devices and network connections.
To get started with Stream, visit Stream from your Dashboard or sign up. Your Stream videos are not attached to a domain in your Cloudflare account, and you do not need a domain on Cloudflare to use Stream.
Option 2: Stream Delivery (Enterprise only)
Stream Delivery offers caching and delivery of video content through Cloudflare data centers around the globe. This CDN feature is only available on the Cloudflare Enterprise Plan. Please contact sales if you'd like to explore this option.
Getting information on the content you are delivering
If you need more information about the content your zone is serving (for example, content type), you can use the following tools:
Cache Analytics users: Open the Caching tab on the Dashboard to filter by content type and identify the type of traffic you are transferring.
Users without Cache Analytics: Open the Analytics tab on the Dashboard and select the Performance section for information about the content you are serving.
Still have questions? Contact support
If you have additional questions about redirection (e.g. if you believe your content was redirected in error and have supporting evidence), file a support ticket and include the following information:
Name of your domain
Description of the problem
Description of the content you're serving through Cloudflare's network

Policies


Licenses
All documentation in the Cloudflare Workers documentation website, including reference documentation and tutorials, are licensed under the CC-BY-SA 4.0 license. Any contributions to the GitHub repository for this project will be licensed under CC-BY-SA 4.0: thanks for your contributions!
Code contributions, such as snippets in the Template Gallery and the code that serves this website via Cloudflare Workers, are licensed under the Apache License, Version 2.0 and The MIT License.

Customer abuse report obligations
Cloudflare permits any interested party to submit abuse reports directly to Cloudflare via abuse.cloudflare.com.
Abuse reports may be submitted for suspected copyright or trademark infringement, illegal, or harmful content (for example, child sex abuse materials), technical abuse (for example, phishing or malware), or other reasons.
You may receive an abuse report from our Trust & Safety team if an abuse report identifies a URL for a domain associated with your Cloudflare account. If you do not provide or monitor an abuse contact, Cloudflare will send abuse reports to your hosting provider.
Our Trust & Safety team sends abuse reports to the domain owner or the abuse point of contact on your account.
To assist with timely resolution and avoid potential service interruptions:
Confirm that the abuse contact email address associated with your account is actively managed and monitored for potential abuse report notifications.
Consider using a mailing list email address that goes to multiple people or teams within your organization instead of the email address for an individual person.
Respond to any abuse report notification within 24 hours. In your response, include any information that you believe will be relevant to Cloudflare in its assessment of the abuse report. Failure to respond in a timely manner or to address the concerns in the abuse report may result in the removal or blocking of reported content, websites, or apps and suspension or termination of Cloudflare services for the associated account.

Blocked Content
If your domain has content that has been blocked, Blocked Content on the dashboard gives you the ability to request the Trust and Safety team to remove a block.
To view Blocked Content on the dashboard:
In the Cloudflare dashboard, go to the Blocked Content page.
https://dash.cloudflare.com/?to=/:account/blocked-content
:::note
You must have Admin, Super Admin, or Trust and Safety role to access Blocked Content.
:::
The Security Center dashboard displays three statuses for blocked content: active, pending, or resolved blocks.
Active blocks
An active block is a block that is in effect on blocking content.
When you select Request Review, the status changes to In Review, and the block will be reviewed by the Trust and Safety team.
Pending blocks
A pending block represents a blocking action Cloudflare will take at the scheduled time.
You can view all your pending blocks by selecting Pending on the dashboard. Selecting Request Review cancels the pending delayed action. This means that the block will not be placed.
Resolved blocks
Resolved blocks list your recently resolved blocks. Resolved blocks are limited to 30 days of recently resolved blocks. Resolved blocks require no action. You can only sort and/or filter the list.

Complaint types
Use Cloudflare's online abuse form to report different types of abuse.
DMCA complaints
Valid Digital Millennium Copyright Act (DMCA) complaints must provide all of the following details:
A physical or electronic signature (typing your full name is valid) of the copyright owner or a person authorized to act on their behalf.
Identification of the infringed copyright (for example, a link to your original work or clear description of the materials allegedly infringed upon).
Identification of the infringing material and information reasonably sufficient to allow Cloudflare to locate the material on the infringing website (for example, a link to the site where the infringed copyrighted material appears).
Your contact information, including your address, telephone number, and email address.
A statement that you believe, in good faith, that the use of the material in the manner asserted is not authorized by the copyright owner, its agent, or the law.
A statement that the information in the notification is accurate, and, under penalty of perjury, that you are authorized to act on behalf of the copyright owner.
Phishing
Valid phishing reports must provide all of the following details:
The domain in question.
The specific link to the phishing page.
After Cloudflare confirms existence of the phishing page, Cloudflare provides a warning page to visitors accessing the phishing link. Cloudflare also notifies the site owner to clean the malicious files from their origin web server.
Trademark infringement
Cloudflare only acknowledges abuse reports from trademark holders or their legally authorized representatives.
For more details about what information is required, refer to our abuse form.
Malware sites
Legitimate reports of malware URLs are blocked from loading via Cloudflare.
For more details about what information is required, refer to our abuse form.
Child exploitation material
Cloudflare promptly responds to all valid reports of child exploitation material. When Cloudflare is made aware of a website solely dedicated to the sharing or promotion of child exploitation material, the offending website is immediately removed from our network without notice.
For an expedited review, report child exploitation material via our abuse form.
Our Trust & Safety team files a complaint with the National Center for Missing and Exploited Children but suggest that you also file a complaint.

Abuse
Cloudflare offers security and reliability services to millions of websites, helping prevent online abuse and make the Internet more secure.
When it comes to reports of abuse on websites that use our services, our ability to respond depends on the type of Cloudflare service at issue. Most abuse reports we receive pertain to websites that use our pass-through security and content delivery network (CDN) services, while far fewer reports relate to websites using our registrar services or our services to host content at the edge. Because Cloudflare offers a variety of Internet infrastructure services to users, our abuse reporting system is designed with those different services in mind.
Resources
Read abuse policy
Review complaint types
Providing specific URLs
Submit abuse report

Providing specific URLs
If you are submitting an abuse report to Cloudflare because our IP address appears in the WHOIS and DNS records for a website, it is very likely that the website is one of millions of websites that use our pass-through security and content distribution network (CDN) services. Because assets on the same website may be hosted by different providers, it is important that you submit the URL for that specific asset to enable appropriate action. This guide will teach you how to identify URLs for specific video or images on a webpage.
Get the URL for specific content
To get the URL for a specific piece of content on a webpage:
Open your web browser (Google Chrome, Safari, Firefox, Edge).
Go to the web page you want to report.
Right click on the content you wish to report (often a video or image).
Select Inspect Element.
In the DevTools panel, look for the src attribute in the selected the image, video, or iFrame.
Copy the URL.
Providing the most specific and helpful URL enables Cloudflare to correctly identify any services it may be providing with respect to that content.
Submitting the abuse report
Once you have identified the URL for the specific asset, you can submit an abuse report through Cloudflare's online abuse reporting process.
You can learn more about the process, and what you can expect from Cloudflare in response to such abuse reports, from our abuse policy.

View and submit reports
Submit reports
Cloudflare provides security, performance, and reliability services to millions of websites. When you report abuse involving a website that uses Cloudflare, Cloudflare's ability to respond depends on the Cloudflare service involved. Many reports involve websites using Cloudflare's pass-through CDN and security services, while others involve domains registered through Cloudflare Registrar or content hosted on Cloudflare's developer platform.
If you find abusive content on a website that uses Cloudflare, you can submit a report in one of three ways:
Public form: Use Submit an abuse report to report abuse to Cloudflare. This form is available to anyone on the Internet.
Cloudflare dashboard: Entitled Cloudflare customers can submit abuse reports from the Abuse reports page. You must have the Trust & Safety, Admin, or Super Admin role.
https://dash.cloudflare.com/?to=/:account/abuse-reports
Cloudflare API: Entitled Cloudflare customers can submit abuse reports using the Abuse Reports API. You must have the Trust & Safety, Admin, or Super Admin role.
View submitted reports
Entitled Cloudflare customers with the Trust & Safety, Admin, or Super Admin role can view abuse reports against content associated with their account.
In the Cloudflare dashboard, go to the Abuse reports page.
https://dash.cloudflare.com/?to=/:account/abuse-reports
Optionally, filter reports by date, report status, report type, or domain.
If Cloudflare applied a mitigation to your website because of an abuse report, you may be able to request a review of that mitigation in the dashboard or using the Abuse Report Mitigations API. Cloudflare will review the request and may remove the mitigation.
Receive notifications
You can enable abuse notifications for your account to configure email, webhook, or PagerDuty alerts about new abuse reports against your websites.
For help setting up alerts, refer to Configure Cloudflare notifications.

Security


Scan for PCI compliance
:::note
Cloudflare is PCI certified as a Data Processor. Refer to PCI compliance and vulnerabilities mitigation and Cloudflare's PCI DSS Responsibility Matrix for more information.
:::
PCI scanners are tools used to identify security weaknesses. When a business undergoes a compliance audit, PCI scan results are used for compliance verification.
Initiate a scan
Identify which server your scan should target. Are you scanning against your origin server, where your applications are hosted, or at a proxy server sitting in front of your origin, such as Cloudflare?
On your scanner tool, enter a public URL or an IP address. If you enter a public website URL, the scanner will resolve the hostname and scan the resulting the IP address. To scan your origin server, be sure to enter your origin server's IP address or a hostname that resolves to the origin server's IP, not a proxy server.
Start the scan and analyze the results.
(Optional) Run another scan for a different origin server.
Open ports versus blocked traffic
Cloudflare's anycast network operates in a way that keeps ports other than 80 and 443 open, allowing it to serve traffic for other customers on these ports.
However, customers can easily block all unwanted traffic to these ports by using Cloudflare WAF Managed Rules or custom rules. The PCI scan will show the ports being open, but the traffic will not reach your origin server. This concern is often misunderstood.
Additional resources
You can find all our public compliance resources in the following pages:
Certifications and compliance resources
Compliance documentation
You can access Compliance documents in the Cloudflare dashboard by selecting your account where you are a Super Administrator and then navigating to Support > Compliance Documents.

Protect your origin server
Your origin server is a physical or virtual machine that is not owned by Cloudflare and hosts your application content (data, webpages, etc.).
Receiving too many requests can be bad for your origin. These requests might increase latency for visitors, incur higher costs — particularly for cloud-based machines — and could knock your application offline.
Secure origin connections
When you secure origin connections, it prevents attackers from discovering and overloading your origin server with requests.
DNS:
Proxy records (when possible): Set up proxied (orange-clouded) DNS records to hide your origin IP addresses and provide DDoS protection. As part of this, you should allow Cloudflare IP addresses at your origin to prevent requests from being blocked.
Review DNS-only records: Audit existing DNS-only records (
SPF, 
TXT, and more) to make sure they do not contain origin IP information.
Evaluate mail infrastructure: If possible, do not host a mail service on the same server as the web resource you want to protect, since emails sent to non-existent addresses get bounced back to the attacker and reveal the mail server IP.
Rotate origin IPs: Once onboarded, rotate your origin IPs, as DNS records are in the public domain. Historical records are kept and would contain IP addresses prior to joining Cloudflare
Application layer
Transport Layer
Network Layer
Monitor origin health
For passive monitoring, create notifications for Origin Error Rate Alerts to receive alerts when your origin returns 5xx codes above a configurable threshold and Passive Origin Monitoring to see when Cloudflare is unable to reach your origin for a few minutes.
For more active monitoring, set up standalone health checks for your origin.
:::note
If you have multiple servers and want to proactively prevent origin problems, set up load balancing as an add-on service.
:::
Zero Downtime Failover
If you have another 
A or 
AAAA record in your Cloudflare DNS or your Cloudflare Load Balancer provides another endpoint in the same pool, Zero-Downtime Failover automatically retries requests to your origin even before a Load Balancing decision is made.
Reduce origin traffic
Block traffic
For more details, refer to Secure your website.
Increase caching
The cache stores data from your application (webpages, etc.) at Cloudflare data centers around the world, which reduces the number of requests sent to your origin server.
Distribute traffic
To randomly distribute traffic across multiple servers, set up multiple DNS records.
For more fine-grained control over traffic distribution — including automatic failover, intelligent routing, and more — set up our add-on load balancing service.
To protect specific endpoints from being overwhelmed by traffic spikes, set up a waiting room.

Recovering from a hacked site
If your website has been hacked recently, review the recommended steps below to recover a hacked website and prevent future hacks.
Recovering from an attack
To recover from an attack, reach out to your hosting provider to request:
Details about the hack, including how they believe the site was hacked.
That your hosting provider remove any malicious content placed on your website.
Once the hack has been resolved, you should resolve site warnings in Google Webmaster Tools and resubmit your site for Google's review.
Preventing and mitigating the risks of a future hack
To prevent the risk of a hacked site:
Activate Cloudflare's WAF managed rules so they can challenge or block known malicious behavior.
If you use a Content Management System (CMS), make sure you have the most recent version installed (CMS platforms push out updates to address known vulnerabilities).
If you use plugins, make sure they are updated.
If you have an admin login page, protect it with Cloudflare's Rate limiting rules or a Cloudflare Access policy.
Use a backup service so you can avoid losing valid content.

Under a DDoS attack?
Common signs of an attack
Common signs that you are under DDoS attack include:
Your site is offline or slow to respond to requests.
Unexpected spikes appear in the graph of Requests Through Cloudflare or Bandwidth in your Cloudflare Analytics app.
Strange requests appear in your origin web server logs that do not match normal visitor behavior.
:::note
If you are currently under DDoS attack, refer to Proactive DDoS defense best practices.
:::

Two-factor authentication
Configure security key authentication for two-factor Cloudflare login
:::caution
Security keys only work with browsers that support the WebAuthn protocol.
:::
A security key provides phishing-resistant multifactor authentication to your Cloudflare account using a built-in authenticator (Apple Touch ID, Android fingerprint, or Windows Hello) or an external hardware key (like YubiKey) that connects to your computer through USB-A, USB-C, NFC, or Bluetooth.
Cloudflare recommends configuring multiple security keys. With multiple keys, you can still use 2FA if the primary key is unavailable or if you are working on a different device.
After enabling 2FA on your Cloudflare account, you can select Manage to configure 2FA security key authentication.
Built-in authenticators
You can configure a built-in authenticator such as Apple Touch ID, Android fingerprint, or Windows Hello.
In Security Key Authentication, select Add.
On the Add a Security Key, enter your Cloudflare password and select Next.
Interact with your built-in authenticator to add it to your Cloudflare account.
Enter a name for the built-in authenticator. If this is the initial setup, you will be prompted to generate backup codes. If not, skip to Step 8.
Enter your Cloudflare password.
Select Next to review your backup codes. Backup codes can be used to access your user account without your mobile device.
Select Download, Print, or Copy to save your backup codes in a secure location.
Select Next to finish the configuration.
Security keys
You can configure a security key, such as a Yubikey, to use with your account. Before you begin, ensure your hardware security key is configured and plugged in.
On a Windows device, you may need to set up Windows Hello or register your security key to your Microsoft account. Review the Windows documentation for more details.
Once your security key is plugged in, go to Profile > Authentication.
From Two-Factor Authentication, select Set up.
From Security Key Authentication, select Add.
Enter your Cloudflare password on the Add a Security Key screen, then select Next.
Interact with your security key to add it to your Cloudflare account. Ensure that the dialog is for the security key setup. If the Windows Hello dialog appears on a Windows device, select Cancel. The security key dialog box will then appear. Depending on your system, you may be required to register a PIN for the security key.
Enter a name for the security key. If this is the initial setup, you will be prompted to generate backup codes. If not, skip to Step 8.
Enter your Cloudflare password.
Select Next to review your backup codes. Backup codes can be used to access your user account without your mobile device.
Select Download, Print, or Copy to save your backup codes in a secure location.
Select Next to finish the configuration.
Configure TOTP mobile application authentication
Time-based one-time password (TOTP) authentication works by using an authenticatior app, such as Google Authenticator or Microsoft Authenticator, which generates a secret code shared between the app and a website. When you log in to the website, you enter your username, password, and the secret code generated from the authenticator app. The secret code is only valid for a short period of time, about 30 to 60 seconds, before a new code is generated.
Once your security key is plugged in, go to Profile > Authentication.
From Two-Factor Authentication, select Set up.
Under Mobile App Authentication, select Add.
Scan the QR code with your mobile device and enter the code from your authenticator application.
Enter your Cloudflare password, then select Next. If you cannot scan the QR code, select Can't scan QR code, Follow alternative steps to configure your authenticator application manually.
Enter your Cloudflare password again.
Select Next to review your backup codes. You can use backup codes to access your account without your mobile device.
Select Download, Print, or Copy to save your backup codes in a secure location.
:::note
To avoid being locked out of your account, be sure to generate and save your recovery codes. If you forget your password and cannot receive the reset code or lose access to your phone with the authenticator app, you can use the recovery codes to access your account.
You can regenerate your backup codes at any time using the Cloudflare dashboard.
:::
Select Next on the backup code page to complete the recovery code setup.
Reconfigure TOTP mobile application authentication
You may need to reconfigure your mobile application authentication if you join a new organization or lose access to your mobile device. When you reconfigure your mobile application authentication, your previous TOTP codes are invalid.
:::note
Reconfiguring TOTP mobile application authentication does not turn off 2FA.
:::
To reconfigure, follow Steps 1-7 as detailed above.
Configure email two factor authentication
Email 2FA works by sending you a TOTP code to your email address. This is a good option particularly if you are concerned about losing a hardware based key.
Navigate to User Profile, then Authentication.
Under Two-Factor Authentication, select Set up.
Under Email Authentication, select Enable.
You will be prompted to enter your password twice, and then be shown recovery codes. Save these somewhere safe like a password manager.
Regenerate backup codes
Each backup code is one-time use only, but you can always request a new set of backup codes using the Cloudflare dashboard. This is useful if you have lost access to or used all of your previous backup codes.
:::note
Regenerating your backup codes will invalidate your previous codes.
:::
Log in to the Cloudflare dashboard.
https://dash.cloudflare.com/?to=/:account/home
Select My Profile.
Select Authentication.
For Two-Factor Authentication, select Manage.
For Backup codes, select Regenerate to generate and save a new set of two-factor backup codes.
Disable two-factor authentication for your Cloudflare account
To disable 2FA for your Cloudflare account, you must delete all security keys and TOTP authenticators from your account.
:::note
If you are not the Super Administrator of an organization with 2FA Enforcement enabled, you may not have permission to disable 2FA.
:::
Log in to the Cloudflare dashboard.
https://dash.cloudflare.com/?to=/:account/home
Select Profile.
Select the Authentication.
To remove your security key:
Select Edit in the Security Key Authentication card. A drop-down menu shows more details about your security key.
Select Delete.
Enter your Cloudflare password, then select Remove.
To remove your TOTP mobile application authentication:
Select Delete method in the Mobile App Authentication card.
Enter your Cloudflare password, authenticator application code, or a recovery code, then select Disable.
Use a backup code
If you lose access to a mobile device, security key, or authentication code, you can solve these issues by using a backup code or retrieving a backup code from your preferred authentication app.
Refer to Google's documentation to transfer Google Authenticator codes from one Android device to another.
When setting up 2FA, you should have saved your backup codes in a secure location. To restore lost access using a Cloudflare backup code:
Retrieve the backup code from where you stored it.
Go to the Cloudflare login page, enter your username and password and select Log in.
https://dash.cloudflare.com/?to=/:account/home
You should see a page titled Two-Factor Authentication
If it has a text box, enter one of your backup codes and select Log in.
If instead you see "Insert your security key and touch it", cancel any prompts from your browser that appear and select try another authentication method or backup code. Proceed to enter one of your backup codes and select Log in.
:::note
Once you use a backup code, it becomes invalid.
:::
Related resources
Google Authentication documentation
YubiKey documentation
Set up multi-user accounts on Cloudflare
Account recovery

Account recovery
If you do not have access to your 2FA account or backup codes and cannot currently generate a 2FA code, use a verified device that you have logged in from before to request a temporary access code.
Log into the Cloudflare dashboard.
https://dash.cloudflare.com/?to=/:account/home
On the Two-Factor Authentication page, select Try recovery on Lost all 2FA devices and backup codes?.
Select Begin recovery.
An access code will be sent to the email address associated with your Cloudflare account.
Enter the temporary access code into the Cloudflare Dashboard and select Verify email.
Select Verify device. This checks whether you are using a device that has previously logged into your account.
If you see Device verified, you will receive an email within 3-5 days with instructions to regain access to your account. It is important to note this process cannot be expedited, so you will need to wait until that email arrives before you can proceed.
If you see Device verification failed, you may be able to try again considering the following:
If you clear your cookies often or are logging in from a different IP address, you have wiped Cloudflare's memory of your device and will need to use a different device to verify.
Your browser may be set to clear cookies on exit or after browser or OS upgrades. This interferes with the device verification process.
You may be using anti-malware or other software that automatically clears your browser cookies and makes your device unregognizable by Cloudflare's Dashboard.
If you are still unable to verify your device, follow the instructions to Request manual verification on the Device verification failed page.

Email address and password
:::note
You cannot change your email address if your administrator has enabled single sign-on (SSO) or if you did not successfully verify the original email address.
For example, if the email address was entered incorrectly or is a non-working email address, you will need to create a new account with a working email address and move domains.
:::
To change the email address associated with your Cloudflare account:
Go to your Profile.
Select your account.
In the Email Address panel, select Change Email Address.
In the dialog, enter your new email address in New email and Confirm email.
Enter your current password.
Select Save.
:::caution[Billing and notification email addresses must be updated separately]
Changing your email address updates your user profile email, but you may have specified separate emails to receive billing invoices and other types of notifications. You will also need to update those email addresses if you want to receive those emails at your new address.
:::
Change password
:::note
If your administrator has enabled Single sign-on (SSO), you cannot change your Authentication settings.
:::
To change your Cloudflare password:
Go to your Profile.
Select your account.
Select Authentication.
On Password, select Change Password.
Change your password and select Save.
For added account security, consider changing your API tokens as well.
Forgot your email address
:::note
If you are an Enterprise customer and forgot the email address associated with your account, contact your account team.
:::
If you forget the email address associated with your application:
Go to the Cloudflare dashboard and select Forgot your email?.
Enter your domain name.
Cloudflare will send an email to the email address associated with your domain name. If you do not receive an email within 20 minutes, check your spam folder. The message will be sent from 
no-reply@cloudflare.com or 
noreply@notify.cloudflare.com.
Forgot your password
:::note
You must be logged out of the Cloudflare dashboard to view the Forgot your password? option.
:::
If you forget the password associated with your email address, or if you initially signed up for Cloudflare using social login (for example Google, Apple), you can use this process to set a new password.
Go to the Cloudflare dashboard and select Forgot your password?.
Enter your email address.
Cloudflare will send an email with instructions to reset your password. If you do not receive an email within 20 minutes, check your spam folder. The message will be sent from 
no-reply@cloudflare.com or 
noreply@notify.cloudflare.com.
:::note
This process does not affect your account or share your email address with anyone.
:::
If you still cannot access the email address associated with your Cloudflare account, you may need to move your domain to another account.
Cloudflare requires these steps to prevent account hijacking.

Profile settings
From your Profile, you can modify settings that affect the Cloudflare dashboard.
Language
Change the language used throughout the Cloudflare dashboard.
Log in to the Cloudflare dashboard.
https://dash.cloudflare.com/?to=/:account/home
Go to Profile.
From Settings > Language, select a language.
Your dashboard will update to the new language automatically.
Dashboard appearance
Adjust how the Cloudflare dashboard appears on your device.
Log in to the Cloudflare dashboard.
https://dash.cloudflare.com/?to=/:account/home
Go to Profile.
From Settings > Dashboard appearance, choose a value:
Dark: Defaults to darker colors.
Light: Defaults to lighter colors.
Use system setting: Defaults to the option used on your device.
Your dashboard display will update to the new appearance setting automatically.
Notifications
Choose the type of notifications you receive from Cloudflare, such as marketing announcements or insights about your domain.
To update the communication preferences for your profile (which requires a verified email address):
Log in to the Cloudflare dashboard.
https://dash.cloudflare.com/?to=/:account/home
Go to Profile.
Select Notifications.
Choose the categories of notifications you want to receive. Your choices are saved automatically.
:::note
All email notifications from Cloudflare are sent from noreply@notify.cloudflare.com. If you are not receiving emails from Cloudflare, you may have marked Cloudflare as spam.
To continue receiving emails, make sure Cloudflare is added as a trusted sender.
:::
Refer to Cloudflare Notifications to receive information about your account, such denial-of-service attacks or server issues.
Timezone
Choose to set the timezone in the Cloudflare dashboard as Coordinated Universal Time (UTC) or your browser or system's timezone.
Log in to the Cloudflare dashboard.
https://dash.cloudflare.com/?to=/:account/home
Select your Profile.
Select Set Timezone and choose either Standard (UTC) or Local (CST).
The page reloads to apply the new setting.

Delete your Cloudflare account
:::note
These steps do not apply to accounts under contract. Contact your account team for more information.
:::
Who can delete their account
If your account uses Single-Sign On (SSO), your super administrator may need to delete your account on your behalf.
If your account does not use SSO, you can delete your account on your own.
Prerequisites
Before Cloudflare can cancel your account and delete your personal information, you will need to follow the process below for each domain associated with your Cloudflare account:
Cancel your subscriptions or add-on services
Remove your domain from Cloudflare
Remove Cloudflare nameservers at your domain registrar
Disable auto-renew for your Registrar domain(s)
If you are using a Cloudflare CNAME setup, update your DNS records at your DNS provider to point to your website IPs or hostnames instead of Cloudflare.
Delete payment information
(Optional) Download a copy of your invoices. Once deleted, the invoices will no longer be accessible and cannot be re-sent to you.
Delete your Cloudflare account
When you sign up for Cloudflare, we create a user profile for you and an account named 
youremail@example.com's account, and your user profile is the admin for the newly create account. Your user profile is where you manage preferences like your password or language, while your account is where you'll manage Cloudflare product configurations.
:::note
Your user profile can be invited to other Cloudflare accounts, so you may have access to more than one account.
:::
When you delete your profile, the account associated with your profile and any accounts where you are the last active member will also be deleted. Deleting your account is permanent. Any accounts where you are the primary owner will also be deleted and any other users on those accounts will be removed.
After you delete your profile, you can use the email address with your profile to create a new account. In most cases, your email should be freed up to be used in a new signup right away.
However, this may not be the same for users who have a lock on their account (for legal purposes).
All domains, subscriptions, and billing information on your account will be removed from Cloudflare.
Log in to the Cloudflare dashboard.
https://dash.cloudflare.com/?to=/:account/home
Select My Profile.
Select Delete this user.
Select Delete user.
Follow the prompts to finish deleting your account.
:::note
Cloudflare will purge your personal information within a year of a deletion request unless required to retain it for legal obligations (such as ongoing abuse investigations or pending litigation). Refer to the Cloudflare Data Processing Addendum for further information about the deletion of personal information following the cancellation of your account.
:::

User profiles


Log in to Cloudflare
Go to the Cloudflare dashboard and choose your sign-in option.
https://dash.cloudflare.com/?to=/:account/home
Sign-in options
Cloudflare offers the following sign-in options:
Email and password
Enter your email address and password.
Single Sign-On (SSO)
If your admin has enabled enabled SSO, enter your email address.
Social login
Social login allows you to sign in with a trusted 3rd party sign in service such as Apple, Google, or GitHub. Social login is only available for accounts with a verified email address, or accounts that signed up via social login initially. If you have additionally configured two-factor authentication on your account, that will be presented in addition to any login and two-factor authentication provided by the social login provider.
:::note
If you log in to your Cloudflare user account with Single Sign-On (SSO), you will not be able to use social login.
:::
:::caution
If you use social login to sign in, your user profile will not have a password associated with it at first. Some operations, such as enabling 2-Factor Authentication or creating API tokens, require setting a password.
To set a password, go to Forgot Password in the Cloudflare dashboard, paste your email address, and click Send.
You will receive an email with instructions to set your password. Once created, use your email and the new password to log in.
:::
Sign in with Apple
Same Cloudflare account email as Apple ID: You can sign in with either your email and password or sign in with Apple.
Different Cloudflare account email as Apple ID: This option creates a new Cloudflare account. If you want to log in to an existing account, change your email address to match the one used for your Apple ID.
If you chose to share your email when creating a Cloudflare account with Apple ID and want to set a password and obtain an API key, go to the Cloudflare dashboard login page and select Forgot your password? to trigger a password reset email.
If you have chosen to hide your email when creating a Cloudflare account with Apple ID, resetting your password will not work. You can use the suggested workaround below:
Add a new member to your account using your secondary email address.
Register a new Cloudflare account with your secondary email address and set a password.
Access the Cloudflare dashboard with the new user and password to obtain an API key.
Changing your Cloudflare account email address will unlink the login credentials with the Apple ID from your Cloudflare account. If you attempt to log in using the same Apple ID after the email is changed, you will create a new Cloudflare account.
If you created your Cloudflare account using Apple Relay and decide to change your Apple ID or email address, you will be unable to retrieve the Cloudflare account and all login options will be permanently lost.
Sign in with Google
A Cloudflare account has already been created with your Google account's email: This option is unavailable at this time, but we are working on the capability to link and unlink social login providers to your Cloudflare account.
If you select Sign in with Google with an email that does not already have a Cloudflare account associated with it, Cloudflare will create a new account and allow you to sign in using Sign in with Google option moving forward.
Sign in with GitHub
Sign in with GitHub uses the Primary email address which is set on your GitHub account. If you change your primary email address in GitHub, you will not be able to log into your Cloudflare account using GitHub social login.
If you select Sign in with GitHub with an email that does not already have a Cloudflare account associated with it, Cloudflare will create a new account and allow you to sign in using Sign in with GitHub option moving forward.

Multi-Factor Email Authentication
Cloudflare uses a Multi-Factor Email Authentication (MFA) method for increased account security. MFA prevents customer account takeovers when attackers gain unauthorized access to an account due to an exposed or easily guessed password.
Cloudflare will challenge any login attempt if the user provides the correct credentials from an unrecognized IP address.
Cloudflare challenges the login by sending a one-time code that expires in 30 minutes to the email that we have on file for the account. Once the correct code is provided through the dashboard, your IP will be recorded and further login attempts from that IP address will not be challenged for 90 days.
:::note
Email MFA can only be disabled by enabling two-factor authentication
:::
Troubleshoot MFA
Cloudflare emails are sometimes flagged as spam by the recipient's email service. If you are expecting an authentication token, you should check the spam folder for any Cloudflare emails and configure a filter to allow Cloudflare emails from no-reply@notify.cloudflare.com_._
Other times, emails are rejected by the recipient email service. Cloudflare will try again it will flag your email address after several attempts and no further emails will be sent.
If you still do not receive an email after ensuring your email service is not flagging Cloudflare, contact Cloudflare Support.
Related resources
Secure user access with two-factor authentication

Verify email address
For security reasons, Cloudflare attempts to verify the email address associated with your account. You cannot perform certain tasks within the Cloudflare dashboard -- for example, adding a new member, changing your email address or updating your communication preferences -- without verifying your email.
When creating your account
When you first create an account, Cloudflare automatically sends a message to the email address you provided for your account.
To verify your email:
Log in to your email provider and find your recent message from Cloudflare. If you cannot find the message, check your Spam folder.
Go to the link in the email.
Log in to Cloudflare to verify the email address associated with your account.
:::note
If someone else used your email to sign up for a Cloudflare account, you can remove this account by going to our unintended registration page and entering the information at the end of your confirmation email.
:::
Resend verification emails
If you cannot find your verification email or your email has expired, request another verification email:
Log in to the Cloudflare dashboard.
https://dash.cloudflare.com/?to=/:account/home
Go to My Profile.
For Email Address, select Send verification email (if this option is not available, your email has already been verified).
Verification issues
If you experience issues with your verification link, you might have already verified your email address.
To check your verification:
Log in to the Cloudflare dashboard.
https://dash.cloudflare.com/?to=/:account/home
Go to My Profile.
For Email Address, your email address will have 
(verified) added after it.
If your email is still not verified, try clicking the verification link in a different browser or a private window.
If this still does not work, try resending the verification email to get a new verification link.