> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Cloudflare API token rotation > Learn how to automatically rotate Cloudflare API tokens. > [!NOTE] > > **Rotation Type: Dual-Phase** > > This rotation maintains two active credential sets with overlapping validity, ensuring zero-downtime during rotation cycles. ## Prerequisites * Create a [Cloudflare Connection](https://infisical.com/docs/integrations/app-connections/cloudflare.md). That connection is used to create and delete API tokens on your behalf during rotation. * The connection's API token must include: * **Account** - **API Tokens** - **Edit**, to create and revoke the generated tokens. * **Account** - **Account Settings** - **Read**, so Infisical can validate the connection. See the **Secret Rotation** tab under [Configure API Token and Account ID for Infisical](https://infisical.com/docs/integrations/app-connections/cloudflare.md#configure-api-token-and-account-id-for-infisical) for the exact configuration. ## Create a Cloudflare API token rotation in Infisical > [tab] Infisical UI > > 1. Navigate to your Secrets Management Project's Dashboard and select **Add Secret Rotation** from the actions dropdown. > > ![Secrets Management Dashboard](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/generic/add-secret-rotation.png) > > 2. Select the **Cloudflare API Token** option. > > ![Select Cloudflare API Token](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/cloudflare-api-token/select-cloudflare-api-token.png) > > 3. Configure the rotation behavior, then click **Next**. > > * **Cloudflare Connection** - The connection that will create and delete API tokens during rotation. > > * **Rotation Interval** - The interval, in days, after which a rotation is triggered. > > * **Rotate At** - The local time of day when rotation runs once the interval has elapsed. > > * **Auto-Rotation Enabled** - Whether to rotate automatically on the interval. Turn off to rotate only manually or pause rotation. > > ![Rotation Configuration](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/cloudflare-api-token/step-1.png) > > 4. Set the Cloudflare API token parameters, then click **Next**. > > The **General** tab defines the token Infisical generates: > > * **Token Name** - The name for the generated token, up to 100 characters. A timestamp is appended to each generated token so every rotation produces a distinct name in Cloudflare. > * **Access Policies** - The permissions granted to the generated token. Add a policy for each permission group you want to grant, using **Add policy**. Each policy has: > * **Effect** - Whether to `Allow` or `Deny` the selected permission group. > * **Scope** - The resources the policy applies to: > * `Entire account` - The whole Cloudflare account the connection is bound to. > * `All zones` - Every zone in the account, including zones added later. > * `Specific zones` - Only the zones you select. > * **Zones** - The zones the policy applies to. Shown only when the scope is `Specific zones`, and required in that case. > * **Permission group** - The Cloudflare permission group to grant. The list is fetched through your Cloudflare Connection and filtered to the groups that are valid for the selected scope. > > Policies that target the same effect, scope, and zones are combined into a single policy when the token is created. > > ![Rotation Parameters](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/cloudflare-api-token/step-2.png) > > The **Restrictions** tab optionally limits where the generated token can be used: > > * **Allowed IPs** (optional) - The generated token can only be used from these IP addresses or CIDR blocks, one entry per line. Leave empty to allow any IP. > > * **Disallowed IPs** (optional) - The generated token cannot be used from these IP addresses or CIDR blocks, one entry per line. > > ![Restrictions](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/cloudflare-api-token/restrictions-api-token.png) > > 5. Specify the secret names that the rotated API token will be mapped to. Then click **Next**. > > * **Token ID** - The name of the secret in Infisical where the generated token's ID will be stored. > > * **API Token** - The name of the secret in Infisical where the generated token's value will be stored. > > ![Rotation Secrets Mapping](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/cloudflare-api-token/step-3.png) > > 6. Give your rotation a name and description (optional). Then click **Next**. > > * **Name** - A slug-friendly name for this rotation configuration. > > * **Description** (optional) - Notes about this rotation. > > ![Rotation Details](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/cloudflare-api-token/step-4.png) > > 7. Review your configuration, then click **Create Secret Rotation**. > > ![Rotation Review](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/cloudflare-api-token/step-5.png) > > 8. Your **Cloudflare API Token** rotation is created. The current API token is available as a secret at the mapped path. Rotations will create a new token, switch the active secret to it, then revoke the previous token for zero-downtime rotation. > > ![Rotation Created](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/cloudflare-api-token/step-6.png) > > > [!NOTE] > > > > Infisical sets an expiration on every token it generates, calculated as twice the rotation interval plus one day, with a minimum of 7 days. This guarantees a token can never expire while it is still the active or previous credential. > [tab] API > > To create a Cloudflare API Token rotation, call the [Create Cloudflare API Token Rotation](https://infisical.com/docs/api-reference/endpoints/secret-rotations/cloudflare-api-token/create.md) API endpoint. > > ### Sample request > > ```bash Request theme={"dark"} > curl --request POST \ > --url https://us.infisical.com/api/v2/secret-rotations/cloudflare-api-token \ > --header 'Content-Type: application/json' \ > --data '{ > "name": "my-cloudflare-rotation", > "projectId": "", > "description": "Cloudflare API token rotation", > "connectionId": "", > "environment": "dev", > "secretPath": "/", > "isAutoRotationEnabled": true, > "rotationInterval": 30, > "rotateAtUtc": { > "hours": 0, > "minutes": 0 > }, > "parameters": { > "name": "infisical-rotated-token", > "policies": [ > { > "effect": "allow", > "scope": "account", > "permissionGroupIds": [""] > } > ], > "allowedIps": ["203.0.113.0/24"] > }, > "secretsMapping": { > "tokenId": "CLOUDFLARE_API_TOKEN_ID", > "apiToken": "CLOUDFLARE_API_TOKEN" > } > }' > ``` > > ### Sample response > > ```bash Response theme={"dark"} > { > "secretRotation": { > "id": "", > "name": "my-cloudflare-rotation", > "description": "Cloudflare API token rotation", > "secretsMapping": { > "tokenId": "CLOUDFLARE_API_TOKEN_ID", > "apiToken": "CLOUDFLARE_API_TOKEN" > }, > "isAutoRotationEnabled": true, > "activeIndex": 0, > "connectionId": "", > "rotationInterval": 30, > "rotateAtUtc": { "hours": 0, "minutes": 0 }, > "type": "cloudflare-api-token", > "parameters": { > "name": "infisical-rotated-token", > "policies": [ > { > "effect": "allow", > "scope": "account", > "permissionGroupIds": [""] > } > ], > "allowedIps": ["203.0.113.0/24"] > } > } > } > ``` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.