> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare

> Connect Cloudflare to CloudThinker for DNS management, CDN optimization, and security configuration

Connect your Cloudflare account to enable CloudThinker agents to access documentation, analyze DNS traffic, and query analytics data.

Cloudflare authenticates with an **API token** scoped to specific permissions. Select only the services you need — each service requires its own set of token permissions.

***

## Prerequisites

* A Cloudflare account with API access.
* Your **Account ID** (found in the Cloudflare dashboard right sidebar).
* An **API token** with permissions for your selected services.

<Info>
  You can combine permissions for multiple services into a single token. Limit the token to only the zones and permissions CloudThinker needs.
</Info>

***

## Setup

<Steps>
  <Step title="Get your Account ID">
    Log in to [Cloudflare Dashboard](https://dash.cloudflare.com/) → select any domain → copy your **Account ID** from the right sidebar under the API section.
  </Step>

  <Step title="Create an API token">
    Go to **My Profile → API Tokens → Create Token** and select **Create Custom Token**. Add permissions for the services you want to enable (see [Required permissions](#required-permissions) below). Copy the token immediately — Cloudflare will not display it again.
  </Step>

  <Step title="Connect in CloudThinker">
    Navigate to **Connections → Cloudflare** and enter:

    * **API Token**: the token you created
    * **Account ID**: your Cloudflare account ID
    * **Enabled Services**: select the services you want to use

    Click **Connect**. CloudThinker verifies the credentials and shows a **Connected** status.
  </Step>
</Steps>

<Frame>
  <img src="https://mintcdn.com/cloudthinker/f645vAiA_merh7DD/images/cloudflare/01-connection-dialog.png?fit=max&auto=format&n=f645vAiA_merh7DD&q=85&s=1b39199c51c0187bb31b519f623ce333" alt="Cloudflare connection dialog showing API token, Account ID, and service selection fields" width="1610" height="1018" data-path="images/cloudflare/01-connection-dialog.png" />
</Frame>

<p style={{textAlign: 'center', fontSize: '0.9em', color: '#666', marginTop: '8px'}}>Cloudflare connection dialog with API token, Account ID, and service selection</p>

<Warning>
  Copy your API token immediately after creation. Cloudflare will not display it again, and you'll need to create a new token if lost.
</Warning>

### Create an API token

<Steps>
  <Step title="Navigate to API Tokens">
    Go to [Cloudflare Dashboard](https://dash.cloudflare.com/) → **My Profile** (top right) → **API Tokens**.
  </Step>

  <Step title="Create a custom token">
    Click **Create Token** → **Create Custom Token** (at the bottom).
  </Step>

  <Step title="Configure permissions">
    Add permissions for your selected services:

    **For DNS Analytics:**

    * Account → Account Settings → Read
    * Zone → Zone → Read
    * Zone → Analytics → Read
    * Zone → DNS → Read

    **For GraphQL Analytics:**

    * Account → Account Analytics → Read
    * Zone → Zone Analytics → Read
  </Step>

  <Step title="Set zone resources">
    Under **Zone Resources**, select **Include → All zones** (or specific zones).
  </Step>

  <Step title="Create and copy">
    Click **Continue to summary → Create Token** and copy the token value immediately.
  </Step>
</Steps>

***

## Connection details

| Field                       | Description                                                          | Example |
| --------------------------- | -------------------------------------------------------------------- | ------- |
| **CLOUDFLARE\_API\_TOKEN**  | API token created in your Cloudflare profile                         | —       |
| **CLOUDFLARE\_ACCOUNT\_ID** | Your Cloudflare account ID from the dashboard                        | —       |
| **ENABLED\_SERVICES**       | Services to enable (Documentation, DNS Analytics, GraphQL Analytics) | —       |

***

## Required permissions

### Documentation

No special permissions required. This service provides access to Cloudflare's public documentation.

### DNS Analytics

| Permission       | Access level |
| ---------------- | ------------ |
| Zone             | Read         |
| Analytics        | Read         |
| DNS              | Read         |
| Account Settings | Read         |

### GraphQL Analytics

| Permission        | Access level |
| ----------------- | ------------ |
| Account Analytics | Read         |
| Zone Analytics    | Read         |

<Tip>
  Combine permissions for multiple services into a single token. When possible, restrict the token to specific zones rather than all zones.
</Tip>

***

## Agent capabilities

Once connected, agents can interact with the services you enabled.

| Capability            | Description                                                                     |
| --------------------- | ------------------------------------------------------------------------------- |
| **Documentation**     | Search and reference Cloudflare's official documentation during troubleshooting |
| **DNS Analytics**     | Query DNS traffic patterns, identify anomalies, and analyze query volumes       |
| **GraphQL Analytics** | Run advanced analytics queries for custom traffic and security reports          |

### Verify the connection

```text theme={null}
@alex check the Cloudflare connection and list accessible zones and enabled services
```

### Example prompts

```text theme={null}
@oliver search Cloudflare documentation for WAF best practices and #recommend rule configuration changes
@alex pull DNS analytics for the last 24 hours and #report on query volume and top error types
@alex run a GraphQL analytics query for zone traffic over the last 7 days and #chart the results
```

***

## Troubleshooting

<Accordion title="Authentication failed">
  Verify your API token is correct and hasn't been revoked. Check that the token has the required permissions for your selected services and that the Account ID matches the account the token was created for.
</Accordion>

<Accordion title="Missing analytics data">
  Verify the token has Analytics read permissions. Analytics data may take up to 24 hours to appear for new zones. Check that the zones have traffic generating data.
</Accordion>

<Accordion title="DNS Analytics not working">
  Ensure all four permissions are granted: Zone, Analytics, DNS, and Account Settings. Verify the token has access to the specific zones you're querying and that DNS is proxied through Cloudflare (orange cloud enabled).
</Accordion>

<Accordion title="GraphQL queries failing">
  Verify Account Analytics and Zone Analytics permissions are granted. Check the query syntax against Cloudflare's GraphQL schema and ensure you're querying within the allowed time range.
</Accordion>

***

## Security

* **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later.
* **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection.
* **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
* **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves.

- **Zone restrictions** — limit the API token to specific zones rather than "All zones" when possible to reduce blast radius.
- **IP restrictions** — add IP allowlist restrictions to the token if your CloudThinker IP range is stable.

***

## Related

<CardGroup cols={2}>
  <Card title="MCP Connections" icon="https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/mcp.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=c89b6087a9d233901dea5e354452eff6" href="/guide/connections/mcp" width="24" height="24" data-path="images/icons/mcp.svg">
    Learn about MCP-based integrations
  </Card>

  <Card title="AWS Connection" icon="https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/aws.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=45d526a3e9345214c0345f277da2e829" href="/guide/connections/aws" width="24" height="24" data-path="images/icons/aws.svg">
    Connect your AWS infrastructure
  </Card>
</CardGroup>