Cloudflare Connection

![Navigate Cloudflare Profile](/images/app-connections/cloudflare/cloudflare-navigate-profile.png)

Click **API Tokens > Create Token** to generate a new API token.

![Create API Token](/images/app-connections/cloudflare/cloudflare-create-token.png)

Depending on your use case, add one or more of the following permission sets to your API token:

<Tabs>
  <Tab title="Secret Sync">
    <AccordionGroup>
      <Accordion title="Cloudflare Pages">
        Use the following permissions to grant Infisical access to sync secrets to Cloudflare Pages:

        ![Configure Token](/images/app-connections/cloudflare/cloudflare-pages-configure-permissions.png)

        **Required Permissions:**
        - **Account** - **Cloudflare Pages** - **Edit**
        - **Account** - **Account Settings** - **Read**

        Add these permissions to your API token and click **Continue to summary**, then **Create Token** to generate your API token.
      </Accordion>
      <Accordion title="Cloudflare Workers">
        Use the following permissions to grant Infisical access to sync secrets to Cloudflare Workers:

        ![Configure Token](/images/app-connections/cloudflare/cloudflare-workers-configure-permissions.png)

        **Required Permissions:**
        - **Account** - **Workers Scripts** - **Edit**
        - **Account** - **Account Settings** - **Read**

        Add these permissions to your API token and click **Continue to summary**, then **Create Token** to generate your API token.
      </Accordion>
    </AccordionGroup>
  </Tab>
  <Tab title="PKI">
    <AccordionGroup>
      <Accordion title="ACME DNS Verification">
        Use the following permissions to grant Infisical access to verify certificates using DNS TXT records with ACME:

        ![Configure Token](/images/app-connections/cloudflare/cloudflare-dns-configure-permissions.png)

        **Required Permissions:**
        - **Account** - **Account Settings** - **Read**
        - **Zone** - **DNS** - **Edit**

        Add these permissions to your API token and click **Continue to summary**, then **Create Token** to generate your API token.
      </Accordion>
      <Accordion title="Certificate Sync (Custom SSL)">
        Use the following permissions to grant Infisical access to sync certificates to Cloudflare as Custom SSL certificates:

        ![Configure Token](/images/app-connections/cloudflare/cloudflare-ssl-configure-permissions.png)

        **Required Permissions:**
        - **Account** - **Account Settings** - **Read**
        - **Zone** - **SSL and Certificates** - **Edit**

        These permissions allow Infisical to upload, update, and delete custom SSL certificates in your Cloudflare zones.

        Add these permissions to your API token and click **Continue to summary**, then **Create Token** to generate your API token.
      </Accordion>
    </AccordionGroup>
  </Tab>
  <Tab title="Secret Rotation">
    <AccordionGroup>
      <Accordion title="Cloudflare API Token">
        Use the following permissions to grant Infisical access to create and revoke Cloudflare API tokens during rotation:

        ![Configure Token](/images/app-connections/cloudflare/cloudflare-api-token-configure-permissions.png)

        **Required Permissions:**
        - **Account** - **API Tokens** - **Edit**
        - **Account** - **Account Settings** - **Read**

        The **API Tokens** - **Edit** permission is what allows Infisical to create the replacement token and revoke the previous one on each rotation cycle. Without it, rotation fails when creating the new token.

        <Note>
          **Account Settings** - **Read** is required so Infisical can validate the connection.
        </Note>

        The generated tokens are not granted these permissions. Each rotated token only receives the access policies you configure on the [Cloudflare API Token rotation](/documentation/platform/secret-rotation/cloudflare-api-token) itself.

        Add these permissions to your API token and click **Continue to summary**, then **Create Token** to generate your API token.
      </Accordion>
      <Accordion title="Cloudflare R2 Access Key">
        An R2 access key is a Cloudflare API token, so rotating one needs the same **API Tokens** - **Edit** permission, plus read access to R2 so Infisical can list your buckets.

        ![Configure Token](/images/app-connections/cloudflare/cloudflare-r2-access-configure-permissions.png)

        **Required Permissions:**
        - **Account** - **API Tokens** - **Edit**
        - **Account** - **Workers R2 Storage** - **Read**
        - **Account** - **Account Settings** - **Read**

        **API Tokens** - **Edit** is what allows Infisical to create the replacement key and revoke the previous one on each rotation cycle. **Workers R2 Storage** - **Read** is used only to populate the bucket picker when you configure the rotation; without it the picker comes back empty and you cannot select buckets.

        <Note>
          **Account Settings** - **Read** is required so Infisical can validate the connection.
        </Note>

        The generated keys are not granted these permissions. Each rotated key only receives object access to the buckets you select on the [Cloudflare R2 Access Key rotation](/documentation/platform/secret-rotation/cloudflare-r2-access-key) itself.

        Add these permissions to your API token and click **Continue to summary**, then **Create Token** to generate your API token.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

![Generated API Token](/images/app-connections/cloudflare/cloudflare-generated-token.png)

<Warning>
  Keep your API token secure and do not share it. Anyone with access to this token can manage your Cloudflare resources based on the permissions granted.
</Warning>

![Account ID](/images/app-connections/cloudflare/cloudflare-account-id.png)

Save your Account ID for use in the next step.