cloudflare

Troubleshooting

If requests fail, run zero doctor check-connector --env-name CLOUDFLARE_TOKEN or zero doctor check-connector --url https://api.cloudflare.com/client/v4/user/tokens/verify --method GET

How to Use

Base URL

All API requests use: https://api.cloudflare.com/client/v4

1. Verify Token

curl -s "https://api.cloudflare.com/client/v4/user/tokens/verify" --header "Authorization: Bearer $CLOUDFLARE_TOKEN" | jq .

2. List Zones

curl -s "https://api.cloudflare.com/client/v4/zones" --header "Authorization: Bearer $CLOUDFLARE_TOKEN" | jq .

3. Get Zone Details

curl -s "https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID" --header "Authorization: Bearer $CLOUDFLARE_TOKEN" | jq .

4. List DNS Records

curl -s "https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/dns_records" --header "Authorization: Bearer $CLOUDFLARE_TOKEN" | jq .

5. Create DNS Record

Write to /tmp/cloudflare_request.json:

{
  "type": "A",
  "name": "sub.example.com",
  "content": "1.2.3.4",
  "ttl": 3600,
  "proxied": false
}

Then run:

curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/dns_records" --header "Authorization: Bearer $CLOUDFLARE_TOKEN" --header "Content-Type: application/json" -d @/tmp/cloudflare_request.json | jq .

6. Update DNS Record

Write to /tmp/cloudflare_request.json:

{
  "type": "A",
  "name": "sub.example.com",
  "content": "5.6.7.8",
  "ttl": 3600,
  "proxied": true
}

Then run:

curl -s -X PUT "https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/dns_records/RECORD_ID" --header "Authorization: Bearer $CLOUDFLARE_TOKEN" --header "Content-Type: application/json" -d @/tmp/cloudflare_request.json | jq .

7. Delete DNS Record

curl -s -X DELETE "https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/dns_records/RECORD_ID" --header "Authorization: Bearer $CLOUDFLARE_TOKEN" | jq .

8. List Workers Scripts

curl -s "https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/workers/scripts" --header "Authorization: Bearer $CLOUDFLARE_TOKEN" | jq .

9. List KV Namespaces

curl -s "https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/storage/kv/namespaces" --header "Authorization: Bearer $CLOUDFLARE_TOKEN" | jq .

10. List R2 Buckets

curl -s "https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/r2/buckets" --header "Authorization: Bearer $CLOUDFLARE_TOKEN" | jq .

11. Purge Zone Cache

Write to /tmp/cloudflare_request.json:

{
  "purge_everything": true
}

Then run:

curl -s -X POST "https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/purge_cache" --header "Authorization: Bearer $CLOUDFLARE_TOKEN" --header "Content-Type: application/json" -d @/tmp/cloudflare_request.json | jq .

12. List Firewall Rules

curl -s "https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/firewall/rules" --header "Authorization: Bearer $CLOUDFLARE_TOKEN" | jq .

13. Get Zone Analytics

curl -s "https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/analytics/dashboard?since=-1440&continuous=true" --header "Authorization: Bearer $CLOUDFLARE_TOKEN" | jq .

Common DNS Record Types

Type	Purpose	Example Content
A	IPv4 address	1.2.3.4
AAAA	IPv6 address	2001:db8::1
CNAME	Alias to another domain	example.com
MX	Mail server	mail.example.com (with priority)
TXT	Text record (SPF, DKIM, etc.)	v=spf1 include:_spf.google.com ~all
NS	Name server	ns1.example.com
SRV	Service locator	Service-specific format

Guidelines

1. Use API Tokens over Global API Key: API tokens provide scoped, least-privilege access and are the recommended authentication method
2. Pagination: List endpoints return paginated results (default 20-100 per page). Use page and per_page query parameters to iterate
3. Response Structure: All responses include success, errors, messages, and result fields. Always check success before using result
4. Proxied Records: Setting proxied: true routes traffic through Cloudflare CDN and enables security features. Not all record types support proxying
5. Zone ID vs Domain Name: Most API endpoints require the Zone ID (a 32-character hex string), not the domain name
6. Account ID: Workers, R2, KV, and other account-level resources require the Account ID instead of Zone ID
7. Rate Limits: Cloudflare API has rate limits per token. Monitor response headers and implement backoff if you receive 429 responses