# Create a Cloudflare API token

> To connect Cloudflare, InfraNest needs an API token from your Cloudflare account. Here's how to create one with the right permissions.

Source: https://infranest.io/docs/create-a-cloudflare-api-key
Last updated: 2026-09-08

---

This guide is for anyone connecting Cloudflare to InfraNest and needing an API token with the right permissions.

## Overview
- InfraNest needs a Cloudflare API token to manage your DNS and related settings.
- The permissions you choose determine which features InfraNest can offer — from basic DNS management to automations, Workers visibility, and domain registration.
- You only get to see the token once, so you'll need to copy it right away.

## Create the token
1. Sign in to the **Cloudflare dashboard**.
2. Go to **My Profile → API Tokens**.

<!-- manual-screenshot: create-a-cloudflare-api-key-1 — taken by hand in the Cloudflare dashboard; the capture rig cannot reach it -->

3. Select **Create Token**, then **Create Custom Token**.
4. Give the token these permissions:
   - **Zone → DNS → Edit**
   - **Zone → Zone → Read**
   - Also add **Zone → Zone Settings → Edit** and **Zone → Cache Purge** if you want automations to change Cloudflare settings for you (security level, development mode, Always Online) or clear your cache.
   - Also add **Account → Workers Scripts → Read** if you use Cloudflare Workers and want the hostnames they serve listed on the zone page.
   - Also add **Account → Domain Registrar → Edit** if you want to manage your Cloudflare-registered domains.

<!-- manual-screenshot: create-a-cloudflare-api-key-2 — taken by hand in the Cloudflare dashboard; the capture rig cannot reach it -->

5. Select **Continue to summary**, then **Create Token**.
6. Copy the token now — Cloudflare shows it only once.

<!-- manual-screenshot: create-a-cloudflare-api-key-3 — taken by hand in the Cloudflare dashboard; the capture rig cannot reach it -->

> [!WARNING]
> Cloudflare only displays the token once. If you navigate away without copying it, you'll have to create a new one.

## What the permissions are for
- **Zone:Read + DNS:Edit** let InfraNest see your zones and manage records.
- **Workers Scripts:Read** lets InfraNest list the hostnames your Workers answer for. These aren't DNS records, so without this permission they simply won't appear — nothing else is affected, and InfraNest stops asking rather than reporting it as a problem.
- **Zone Settings:Edit + Cache Purge** are only needed by four automation actions — setting a zone's security level, development mode or Always Online, and purging its cache. DNS works perfectly without them; those specific actions just can't run.
- **Domain Registrar:Edit** lets InfraNest renew and manage domains registered at Cloudflare. Leave it out if you only use Cloudflare for DNS.

## How to tell what your token can do
1. Open the Cloudflare account in **Integrations**.
2. Check the **Permission check** panel — it lists what was proven to work.
3. Look under **Extras this key can unlock** for anything missing, along with the actions it would have made possible.

InfraNest runs this check when you connect, when you reconnect, and whenever you select **Test connection**. It only makes calls that change nothing: it clears one address that was never cached, and sets one setting to the value it already has.

> [!NOTE]
> If your token was made before August 2026, it won't have the Zone Settings and Cache Purge permissions — they didn't exist in InfraNest then. Cloudflare can't add a permission to a token that already exists, so create a new token with them ticked and paste it in, or reconnect if you signed in with Cloudflare.

## Next step
Go back to InfraNest and follow **Connect Cloudflare** to paste the token.