Cloudflare

API keyDeveloperOrg connection

Org-level connection

Cloudflare is connected once at the org level by an admin. The credential is shared across all groups that have been granted access — individual team members don't need to connect their own accounts.

Getting your API key

Create a scoped API Token in Cloudflare → My Profile → API Tokens → Create Token. For the target zone(s), grant EDIT scopes so agents can both diagnose and remediate: Zone → Zone Settings: Edit, Zone → DNS: Edit, Zone → Bot Management: Edit (if your plan includes Bot Management), Zone → WAF/Config (Rulesets): Edit, Zone → Cache Purge: Purge, plus Zone → Zone: Read and Zone → Analytics: Read. Then paste the token below. Optionally add your Account ID and a Zone ID to save agents from looking them up.

Ready to connect?

Permissions (scopes)

These are the data scopes On Belay can be granted for Cloudflare. Your org admin controls which scopes are enabled per group.

Scope	Description	Access
`zone:read`	List zones, read zone details and settings	Read only
`zone:write`	Edit zone settings (SSL, redirects, canonicalization)	Read / Write
`dns:read`	Read DNS records (proxied vs DNS-only)	Read only
`dns:write`	Create/update/delete DNS records (toggle proxied)	Read / Write
`bot_management:read`	Read bot & AI-crawler classification config	Read only
`bot_management:write`	Update bot & AI-crawler config (block AI scrapers, managed robots.txt)	Read / Write
`waf:read`	Read WAF/bot/redirect rulesets	Read only
`waf:write`	Create/update/delete WAF/bot/redirect rules	Read / Write
`analytics:read`	Read analytics, AI-crawler metrics, and security events (GraphQL)	Read only
`cache:purge`	Purge cached content	Read / Write

Troubleshooting

"Invalid API key" or "Unauthorized" error

Double-check that you copied the full key without any leading/trailing spaces. Some platforms show a truncated preview — make sure to copy the full token. If the key was generated with restricted scopes, verify it includes the permissions listed above.

Connected but Claude can't access data

Check that your group has been granted access to this integration in On Belay → Groups → [your group] → Integrations. Also verify the specific scopes your group is permitted to use match what your query requires.

The key expires or stops working

Some API keys have expiration policies. Generate a new key in Cloudflare and update it in On Belay → Integrations → Cloudflare → Update key. Consider creating a dedicated service account or machine user for On Belay so the key isn't tied to a personal account.

Still stuck? We're happy to help.

Contact support →