Cloudflare connection

Create API Token

Navigate to your Cloudflare dashboard and go to Profile.Click API Tokens > Create Token to generate a new API token.

Configure Token Permissions

Configure your API token with the necessary permissions for your Cloudflare services.Depending on your use case, add one or more of the following permission sets to your API token:

• Secret Sync
• PKI
• Secret Rotation

Cloudflare Pages

Use the following permissions to grant Infisical access to sync secrets to Cloudflare Pages:Required Permissions:

• Account - Cloudflare Pages - Edit
• Account - Account Settings - Read

Add these permissions to your API token and click Continue to summary, then Create Token to generate your API token.

Cloudflare Workers

Use the following permissions to grant Infisical access to sync secrets to Cloudflare Workers:Required Permissions:

• Account - Workers Scripts - Edit
• Account - Account Settings - Read

Add these permissions to your API token and click Continue to summary, then Create Token to generate your API token.

ACME DNS Verification

Use the following permissions to grant Infisical access to verify certificates using DNS TXT records with ACME:Required Permissions:

• Account - Account Settings - Read
• Zone - DNS - Edit

Add these permissions to your API token and click Continue to summary, then Create Token to generate your API token.

Certificate Sync (Custom SSL)

Use the following permissions to grant Infisical access to sync certificates to Cloudflare as Custom SSL certificates:Required Permissions:

• Account - Account Settings - Read
• Zone - SSL and Certificates - Edit

These permissions allow Infisical to upload, update, and delete custom SSL certificates in your Cloudflare zones.Add these permissions to your API token and click Continue to summary, then Create Token to generate your API token.

Cloudflare API Token

Use the following permissions to grant Infisical access to create and revoke Cloudflare API tokens during rotation:Required Permissions:

• Account - API Tokens - Edit
• Account - Account Settings - Read

The API Tokens - Edit permission is what allows Infisical to create the replacement token and revoke the previous one on each rotation cycle. Without it, rotation fails when creating the new token.

Account Settings - Read is required so Infisical can validate the connection.

The generated tokens are not granted these permissions. Each rotated token only receives the access policies you configure on the Cloudflare API Token rotation itself.Add these permissions to your API token and click Continue to summary, then Create Token to generate your API token.

Cloudflare R2 Access Key

An R2 access key is a Cloudflare API token, so rotating one needs the same API Tokens - Edit permission, plus read access to R2 so Infisical can list your buckets.Required Permissions:

• Account - API Tokens - Edit
• Account - Workers R2 Storage - Read
• Account - Account Settings - Read

API Tokens - Edit is what allows Infisical to create the replacement key and revoke the previous one on each rotation cycle. Workers R2 Storage - Read is used only to populate the bucket picker when you configure the rotation; without it the picker comes back empty and you cannot select buckets.

Account Settings - Read is required so Infisical can validate the connection.

The generated keys are not granted these permissions. Each rotated key only receives object access to the buckets you select on the Cloudflare R2 Access Key rotation itself.Add these permissions to your API token and click Continue to summary, then Create Token to generate your API token.

Save Your API Token

After creation, copy and securely store your API token as it will not be shown again.

Keep your API token secure and do not share it. Anyone with access to this token can manage your Cloudflare resources based on the permissions granted.

Get Account ID

From your Cloudflare Account Home page, click on the account information dropdown and select Copy account ID.Save your Account ID for use in the next step.

Navigate to App Connections

Navigate to the Integrations tab in the desired project, then select App Connections.

Add Connection

Select the Cloudflare Connection option from the connection options modal.

Input Credentials

Enter your Cloudflare API token and Account ID in the provided fields and click Connect to Cloudflare to establish the connection.

Connection Created

Your Cloudflare Connection is now available for use in your Infisical projects.