# Create a Cloudflare API token

> To connect Cloudflare, InfraNest needs an API token from your Cloudflare account. Here's how to create one with the right permissions.

Source: https://infranest.io/docs/create-a-cloudflare-api-key
Last updated: 2026-10-26

---

Create a Cloudflare API token so InfraNest can manage your DNS records, zones, and other Cloudflare settings on your behalf.

## Overview

- InfraNest connects to Cloudflare using an API token you create yourself, scoped to exactly the permissions you choose.
- Which permissions you add determines which InfraNest features work — DNS management needs the basics, but automations and domain management need extra permissions.
- You only get to see the finished token once, so copy it before you leave the Cloudflare dashboard.

## Create the token

1. Sign in to the Cloudflare dashboard.
2. Go to **My Profile → API Tokens**.

   <!-- manual-screenshot: create-a-cloudflare-api-key-1 — taken by hand in the Cloudflare dashboard; the capture rig cannot reach it -->

   <!-- docs-screenshots:start:create-a-cloudflare-api-key-1 -->

   ![Create a Cloudflare API token (1)](/media/ec8d5fd0-94ba-4b19-abd1-dc39615bb7ad)

   <!-- docs-screenshots:end:create-a-cloudflare-api-key-1 -->
3. Select **Create Token**, then **Create Custom Token**.
4. Give the token these permissions:
   - **Zone → DNS → Edit**
   - **Zone → Zone → Read**
   - Also add **Zone → Zone Settings → Edit** and **Zone → Cache Purge** if you want automations to change Cloudflare settings for you (security level, development mode, Always Online) or clear your cache.
   - Also add **Account → Workers Scripts → Read** if you use Cloudflare Workers and want the hostnames they serve listed on the zone page.
   - Also add **Account → Domain Registrar → Edit** if you want to manage your Cloudflare-registered domains.

   <!-- manual-screenshot: create-a-cloudflare-api-key-2 — taken by hand in the Cloudflare dashboard; the capture rig cannot reach it -->

   <!-- docs-screenshots:start:create-a-cloudflare-api-key-2 -->

   ![Create a Cloudflare API token (2)](/media/3350e9db-49e1-4858-ada9-d03c4c244c26)

   <!-- docs-screenshots:end:create-a-cloudflare-api-key-2 -->
5. Select **Continue to summary**, then **Create Token**.
6. Copy the token now — Cloudflare shows it only once.

   <!-- manual-screenshot: create-a-cloudflare-api-key-3 — taken by hand in the Cloudflare dashboard; the capture rig cannot reach it -->

   <!-- docs-screenshots:start:create-a-cloudflare-api-key-3 -->

   ![Create a Cloudflare API token (3)](/media/3ea8bd76-130d-4e80-9a46-3402fbae7d2c)

   <!-- docs-screenshots:end:create-a-cloudflare-api-key-3 -->

> [!WARNING]
> Cloudflare only displays your token once. If you navigate away without copying it, you'll need to create a new one.

## What the permissions are for

- **Zone:Read + DNS:Edit** let InfraNest see your zones and manage records.
- **Workers Scripts:Read** lets InfraNest list the hostnames your Workers answer for. These aren't DNS records, so without this permission they simply don't appear — nothing else is affected, and InfraNest stops asking rather than reporting it as a problem.
- **Zone Settings:Edit + Cache Purge** are only needed by four automation actions — setting a zone's security level, development mode or Always Online, and purging its cache. DNS works perfectly without them; the actions simply can't run.
- **Domain Registrar:Edit** lets InfraNest renew and manage domains registered at Cloudflare. Leave it out if you only use Cloudflare for DNS.

## How to tell what your token can do

1. Open the Cloudflare account in **Integrations**.
2. Check the **Permission check** panel — it lists what was proven.
3. Check **Extras this key can unlock** for anything missing, along with the actions it would have made possible.

InfraNest runs this check when you connect, when you reconnect, and whenever you select **Check connection**. It only makes calls that change nothing: it clears one address that was never cached, and sets one setting to the value it already has.

> [!NOTE]
> If your token was made before August 2026, it won't have the Zone Settings and Cache Purge permissions — they didn't exist in InfraNest then. Cloudflare can't add a permission to a token that already exists, so create a new token with them ticked and paste it in, or reconnect if you signed in with Cloudflare.

## Next step

Go back to InfraNest and follow **Connect** under Cloudflare to paste the token.