> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Cloudflare API Token
> Learn how to automatically rotate Cloudflare API tokens.
**Rotation Type: Dual-Phase**
This rotation maintains two active credential sets with overlapping validity, ensuring zero-downtime during rotation cycles.
## Prerequisites
* Create a [Cloudflare Connection](/docs/integrations/app-connections/cloudflare). That connection is used to create and delete API tokens on your behalf during rotation.
* The connection's API token must include:
* **Account** - **API Tokens** - **Edit**, to create and revoke the generated tokens.
* **Account** - **Account Settings** - **Read**, so Infisical can validate the connection.
See the **Secret Rotation** tab under [Configure API Token and Account ID for Infisical](/docs/integrations/app-connections/cloudflare#configure-api-token-and-account-id-for-infisical) for the exact configuration.
## Create a Cloudflare API Token Rotation in Infisical
1. Navigate to your Secret Manager Project's Dashboard and select **Add Secret Rotation** from the actions dropdown.
2. Select the **Cloudflare API Token** option.
3. Configure the rotation behavior, then click **Next**.
* **Cloudflare Connection** - The connection that will create and delete API tokens during rotation.
* **Rotation Interval** - The interval, in days, after which a rotation is triggered.
* **Rotate At** - The local time of day when rotation runs once the interval has elapsed.
* **Auto-Rotation Enabled** - Whether to rotate automatically on the interval. Turn off to rotate only manually or pause rotation.
4. Set the Cloudflare API token parameters, then click **Next**.
The **General** tab defines the token Infisical generates:
* **Token Name** - The name for the generated token, up to 100 characters. A timestamp is appended to each generated token so every rotation produces a distinct name in Cloudflare.
* **Access Policies** - The permissions granted to the generated token. Add a policy for each permission group you want to grant, using **Add policy**. Each policy has:
* **Effect** - Whether to `Allow` or `Deny` the selected permission group.
* **Scope** - The resources the policy applies to:
* `Entire account` - The whole Cloudflare account the connection is bound to.
* `All zones` - Every zone in the account, including zones added later.
* `Specific zones` - Only the zones you select.
* **Zones** - The zones the policy applies to. Shown only when the scope is `Specific zones`, and required in that case.
* **Permission group** - The Cloudflare permission group to grant. The list is fetched through your Cloudflare Connection and filtered to the groups that are valid for the selected scope.
Policies that target the same effect, scope, and zones are combined into a single policy when the token is created.
The **Restrictions** tab optionally limits where the generated token can be used:
* **Allowed IPs** (optional) - The generated token can only be used from these IP addresses or CIDR blocks, one entry per line. Leave empty to allow any IP.
* **Disallowed IPs** (optional) - The generated token cannot be used from these IP addresses or CIDR blocks, one entry per line.
5. Specify the secret names that the rotated API token will be mapped to. Then click **Next**.
* **Token ID** - The name of the secret in Infisical where the generated token's ID will be stored.
* **API Token** - The name of the secret in Infisical where the generated token's value will be stored.
6. Give your rotation a name and description (optional). Then click **Next**.
* **Name** - A slug-friendly name for this rotation configuration.
* **Description** (optional) - Notes about this rotation.
7. Review your configuration, then click **Create Secret Rotation**.
8. Your **Cloudflare API Token** rotation is created. The current API token is available as a secret at the mapped path. Rotations will create a new token, switch the active secret to it, then revoke the previous token for zero-downtime rotation.
Infisical sets an expiration on every token it generates, calculated as twice the rotation interval plus one day, with a minimum of 7 days. This guarantees a token can never expire while it is still the active or previous credential.
To create a Cloudflare API Token rotation, call the [Create Cloudflare API Token Rotation](/docs/api-reference/endpoints/secret-rotations/cloudflare-api-token/create) API endpoint.
### Sample request
```bash Request theme={"dark"}
curl --request POST \
--url https://us.infisical.com/api/v2/secret-rotations/cloudflare-api-token \
--header 'Content-Type: application/json' \
--data '{
"name": "my-cloudflare-rotation",
"projectId": "",
"description": "Cloudflare API token rotation",
"connectionId": "",
"environment": "dev",
"secretPath": "/",
"isAutoRotationEnabled": true,
"rotationInterval": 30,
"rotateAtUtc": {
"hours": 0,
"minutes": 0
},
"parameters": {
"name": "infisical-rotated-token",
"policies": [
{
"effect": "allow",
"scope": "account",
"permissionGroupIds": [""]
}
],
"allowedIps": ["203.0.113.0/24"]
},
"secretsMapping": {
"tokenId": "CLOUDFLARE_API_TOKEN_ID",
"apiToken": "CLOUDFLARE_API_TOKEN"
}
}'
```
### Sample response
```bash Response theme={"dark"}
{
"secretRotation": {
"id": "",
"name": "my-cloudflare-rotation",
"description": "Cloudflare API token rotation",
"secretsMapping": {
"tokenId": "CLOUDFLARE_API_TOKEN_ID",
"apiToken": "CLOUDFLARE_API_TOKEN"
},
"isAutoRotationEnabled": true,
"activeIndex": 0,
"connectionId": "",
"rotationInterval": 30,
"rotateAtUtc": { "hours": 0, "minutes": 0 },
"type": "cloudflare-api-token",
"parameters": {
"name": "infisical-rotated-token",
"policies": [
{
"effect": "allow",
"scope": "account",
"permissionGroupIds": [""]
}
],
"allowedIps": ["203.0.113.0/24"]
}
}
}
```