> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare connection

> Learn how to configure a Cloudflare Connection for Infisical.

Infisical supports connecting to Cloudflare using API tokens and Account ID for secure access to your Cloudflare services.

## Configure API token and account ID for Infisical

**1. Create API Token**

Navigate to your Cloudflare dashboard and go to **Profile**.

![Navigate Cloudflare Profile](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/cloudflare/cloudflare-navigate-profile.png)

Click **API Tokens > Create Token** to generate a new API token.

![Create API Token](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/cloudflare/cloudflare-create-token.png)

**2. Configure Token Permissions**

Configure your API token with the necessary permissions for your Cloudflare services.

Depending on your use case, add one or more of the following permission sets to your API token:

> [tab] Secret Sync
>
> > [accordion] Cloudflare Pages
> >
> > Use the following permissions to grant Infisical access to sync secrets to Cloudflare Pages:
> >
> > ![Configure Token](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/cloudflare/cloudflare-pages-configure-permissions.png)
> >
> > **Required Permissions:**
> >
> > * **Account** - **Cloudflare Pages** - **Edit**
> > * **Account** - **Account Settings** - **Read**
> >
> > Add these permissions to your API token and click **Continue to summary**, then **Create Token** to generate your API token.
>
> > [accordion] Cloudflare Secrets Store
> >
> > Use the following permissions to grant Infisical access to sync secrets to Cloudflare Secrets Store:
> >
> > ![Configure Token](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/cloudflare/cloudflare-secrets-store-configure-permissions.png)
> >
> > **Required Permissions:**
> >
> > * **Account** - **Secrets Store** - **Edit**
> > * **Account** - **Account Settings** - **Read**
> >
> > Add these permissions to your API token and select **Continue to summary**, then **Create Token** to generate your API token.
>
> > [accordion] Cloudflare Workers
> >
> > Use the following permissions to grant Infisical access to sync secrets to Cloudflare Workers:
> >
> > ![Configure Token](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/cloudflare/cloudflare-workers-configure-permissions.png)
> >
> > **Required Permissions:**
> >
> > * **Account** - **Workers Scripts** - **Edit**
> > * **Account** - **Account Settings** - **Read**
> >
> > Add these permissions to your API token and click **Continue to summary**, then **Create Token** to generate your API token.

> [tab] PKI
>
> > [accordion] ACME DNS Verification
> >
> > Use the following permissions to grant Infisical access to verify certificates using DNS TXT records with ACME:
> >
> > ![Configure Token](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/cloudflare/cloudflare-dns-configure-permissions.png)
> >
> > **Required Permissions:**
> >
> > * **Account** - **Account Settings** - **Read**
> > * **Zone** - **DNS** - **Edit**
> >
> > Add these permissions to your API token and click **Continue to summary**, then **Create Token** to generate your API token.
>
> > [accordion] Certificate Sync (Custom SSL)
> >
> > Use the following permissions to grant Infisical access to sync certificates to Cloudflare as Custom SSL certificates:
> >
> > ![Configure Token](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/cloudflare/cloudflare-ssl-configure-permissions.png)
> >
> > **Required Permissions:**
> >
> > * **Account** - **Account Settings** - **Read**
> > * **Zone** - **SSL and Certificates** - **Edit**
> >
> > These permissions allow Infisical to upload, update, and delete custom SSL certificates in your Cloudflare zones.
> >
> > Add these permissions to your API token and click **Continue to summary**, then **Create Token** to generate your API token.

> [tab] Secret Rotation
>
> > [accordion] Cloudflare API Token
> >
> > Use the following permissions to grant Infisical access to create and revoke Cloudflare API tokens during rotation:
> >
> > ![Configure Token](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/cloudflare/cloudflare-api-token-configure-permissions.png)
> >
> > **Required Permissions:**
> >
> > * **Account** - **API Tokens** - **Edit**
> > * **Account** - **Account Settings** - **Read**
> >
> > The **API Tokens** - **Edit** permission is what allows Infisical to create the replacement token and revoke the previous one on each rotation cycle. Without it, rotation fails when creating the new token.
> >
> > > [!NOTE]
> > >
> > > **Account Settings** - **Read** is required so Infisical can validate the connection.
> >
> > The generated tokens are not granted these permissions. Each rotated token only receives the access policies you configure on the [Cloudflare API Token rotation](https://infisical.com/docs/documentation/platform/secret-rotation/cloudflare-api-token.md) itself.
> >
> > Add these permissions to your API token and click **Continue to summary**, then **Create Token** to generate your API token.
>
> > [accordion] Cloudflare R2 Access Key
> >
> > An R2 access key is a Cloudflare API token, so rotating one needs the same **API Tokens** - **Edit** permission, plus read access to R2 so Infisical can list your buckets.
> >
> > ![Configure Token](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/cloudflare/cloudflare-r2-access-configure-permissions.png)
> >
> > **Required Permissions:**
> >
> > * **Account** - **API Tokens** - **Edit**
> > * **Account** - **Workers R2 Storage** - **Read**
> > * **Account** - **Account Settings** - **Read**
> >
> > **API Tokens** - **Edit** is what allows Infisical to create the replacement key and revoke the previous one on each rotation cycle. **Workers R2 Storage** - **Read** is used only to populate the bucket picker when you configure the rotation; without it the picker comes back empty and you cannot select buckets.
> >
> > > [!NOTE]
> > >
> > > **Account Settings** - **Read** is required so Infisical can validate the connection.
> >
> > The generated keys are not granted these permissions. Each rotated key only receives object access to the buckets you select on the [Cloudflare R2 Access Key rotation](https://infisical.com/docs/documentation/platform/secret-rotation/cloudflare-r2-access-key.md) itself.
> >
> > Add these permissions to your API token and click **Continue to summary**, then **Create Token** to generate your API token.

**3. Save Your API Token**

After creation, copy and securely store your API token as it won't be shown again.

![Generated API Token](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/cloudflare/cloudflare-generated-token.png)

> [!WARNING]
>
> Keep your API token secure and do not share it. Anyone with access to this token can manage your Cloudflare resources based on the permissions granted.

**4. Get Account ID**

From your Cloudflare Account Home page, select the account information dropdown and select **Copy account ID**.

![Account ID](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/cloudflare/cloudflare-account-id.png)

Save your Account ID for use in the next step.

## Setup Cloudflare connection in Infisical

**1. Navigate to App Connections**

Navigate to the **Integrations** tab in the desired project, then select **App Connections**. ![App Connections
Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/general/add-connection.png)

**2. Add Connection**

Select the **Cloudflare Connection** option from the connection options
modal. ![Select Cloudflare
Connection](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/cloudflare/cloudflare-app-connection-select.png)

**3. Input Credentials**

Enter your Cloudflare API token and Account ID in the provided fields and
select **Connect to Cloudflare** to establish the connection. ![Connect to
Cloudflare](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/cloudflare/cloudflare-app-connection-form.png)

**4. Connection Created**

Your **Cloudflare Connection** is now available for use in your Infisical
projects. ![Cloudflare Connection
Created](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/cloudflare/cloudflare-app-connection-created.png)

> [!NOTE]
>
> API token connections require manual token rotation when your Cloudflare API
> token expires or is regenerated. Monitor your connection status and update the
> token as needed.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.