Create a Cloudflare API token

This guide is for anyone connecting Cloudflare to InfraNest and needing an API token with the right permissions.

Overview

• InfraNest needs a Cloudflare API token to manage your DNS and related settings.
• The permissions you choose determine which features InfraNest can offer — from basic DNS management to automations, Workers visibility, and domain registration.
• You only get to see the token once, so you'll need to copy it right away.

Create the token

1. Sign in to the Cloudflare dashboard.
2. Go to My Profile → API Tokens.

3. Select Create Token, then Create Custom Token.
4. Give the token these permissions:
   • Zone → DNS → Edit
   • Zone → Zone → Read
   • Also add Zone → Zone Settings → Edit and Zone → Cache Purge if you want automations to change Cloudflare settings for you (security level, development mode, Always Online) or clear your cache.
   • Also add Account → Workers Scripts → Read if you use Cloudflare Workers and want the hostnames they serve listed on the zone page.
   • Also add Account → Domain Registrar → Edit if you want to manage your Cloudflare-registered domains.

5. Select Continue to summary, then Create Token.
6. Copy the token now — Cloudflare shows it only once.

WarningCloudflare only displays the token once. If you navigate away without copying it, you'll have to create a new one.

What the permissions are for

• Zone:Read + DNS:Edit let InfraNest see your zones and manage records.
• Workers Scripts:Read lets InfraNest list the hostnames your Workers answer for. These aren't DNS records, so without this permission they simply won't appear — nothing else is affected, and InfraNest stops asking rather than reporting it as a problem.
• Zone Settings:Edit + Cache Purge are only needed by four automation actions — setting a zone's security level, development mode or Always Online, and purging its cache. DNS works perfectly without them; those specific actions just can't run.
• Domain Registrar:Edit lets InfraNest renew and manage domains registered at Cloudflare. Leave it out if you only use Cloudflare for DNS.

How to tell what your token can do

1. Open the Cloudflare account in Integrations.
2. Check the Permission check panel — it lists what was proven to work.
3. Look under Extras this key can unlock for anything missing, along with the actions it would have made possible.

InfraNest runs this check when you connect, when you reconnect, and whenever you select Test connection. It only makes calls that change nothing: it clears one address that was never cached, and sets one setting to the value it already has.

NoteIf your token was made before August 2026, it won't have the Zone Settings and Cache Purge permissions — they didn't exist in InfraNest then. Cloudflare can't add a permission to a token that already exists, so create a new token with them ticked and paste it in, or reconnect if you signed in with Cloudflare.

Next step

Go back to InfraNest and follow Connect Cloudflare to paste the token.