3.1 KiB
Cloudflare API token scopes for zone operations
ServerKit connects Cloudflare as a DNS provider with a scoped API token (or a global key). DNS records and Dynamic DNS need only DNS: Edit. The per-zone Cloudflare control panel (reached from a Cloudflare-managed domain) reaches further into your zone, and each tab needs its own token permission.
Grant only what you plan to use. The zone page runs a live scope check and flags any tab your token can't reach, so you can start minimal and widen later.
Scope matrix
| Feature (tab) | Cloudflare API token permission |
|---|---|
| DNS records, Dynamic DNS | Zone → DNS: Edit |
| Settings | Zone → Zone Settings: Edit |
| Cache purge | Zone → Cache Purge: Purge |
| DNSSEC | Zone → DNS: Edit |
| WAF / Redirects / Transforms | Zone → Zone WAF: Edit (or Account → Account Rulesets: Edit) |
| Origin CA | Zone → SSL and Certificates: Edit (see note below) |
| Workers | Account → Workers Scripts: Edit |
| Tunnels | Account → Cloudflare Tunnel: Edit |
| Storage — R2 | Account → Workers R2 Storage: Edit |
| Storage — KV | Account → Workers KV Storage: Edit |
| Storage — D1 | Account → D1: Edit |
Account-scoped features (Workers, Tunnels, Storage) also need Zone → Zone: Read so ServerKit can resolve the account that owns the zone.
Origin CA note
Issuing origin certificates uses the Cloudflare Origin CA API. Most accounts accept a token with SSL and Certificates: Edit. Some accounts require the separate Origin CA key (a per-account key from My Profile → API Tokens → Origin CA Registration). If issuing fails with a permission error, add the Origin CA key to the connection and retry — ServerKit stores it encrypted at rest.
Origin certificates are trusted only between Cloudflare's edge and your origin. Keep the covered hostname proxied (orange cloud) and set the SSL/TLS mode to Full (strict) for end-to-end encryption. A browser reaching your origin directly will reject an origin certificate.
Creating a scoped token
- Cloudflare dashboard → My Profile → API Tokens → Create Token.
- Start from Create Custom Token.
- Add the permissions for the features you want (from the matrix above).
- Scope Zone Resources to the specific zones ServerKit should manage.
- Create the token, copy it, and paste it into ServerKit's Cloudflare connection.
To widen scope later, edit the token in Cloudflare and reconnect — no ServerKit change is needed beyond re-entering the token.