Skip to main content
Connect your Cloudflare account to Annie to inventory DNS records, zones, certificates, WAF, load balancers, Workers, tunnels, Access, and other edge configuration. Annie uses this data during investigations to map hostnames to infrastructure and surface edge-related changes.
Security first: Anyshift only requests read-only access. Prefer Connect with Cloudflare (OAuth / OIDC). An Account API token is available as a fallback. Do not grant Edit or Write permissions.

​
Setup Guide

You can connect Cloudflare in either of two ways. OAuth / OIDC is recommended. Go to Integrations → Cloudflare in Anyshift to start.

​
Connect with Cloudflare (OAuth / OIDC)

Use OAuth when you want a one-click authorize flow without pasting a long-lived API token.
  1. Open Integrations → Cloudflare.
  2. Click Connect with Cloudflare.
  3. Sign in to Cloudflare if prompted, pick the account to authorize, and approve the read-only scopes Anyshift requests.
  4. You return to Anyshift. The page shows the connected Cloudflare account.
Anyshift stores the OAuth tokens encrypted and refreshes them automatically. If the connection status shows that re-authorization is required, click Reconnect and approve again.Anyshift requests these read-only scopes for full inventory. Approving a subset (or using a zone-scoped grant) still works; missing scopes soft-fail and those inventory families may be incomplete.

​
What Annie uses this for

Once connected, Annie can:
  • List zones and DNS records for hostname-to-resource mapping
  • Read zone settings that affect edge behavior (for example SSL mode)
  • Inventory certificates, WAF/firewall rulesets, load balancers, Workers, tunnels, and Access when those Read permissions are present
  • Correlate Cloudflare configuration with your broader infrastructure graph during investigations

​
Troubleshooting

OAuth connect fails or returns to Anyshift with an error
  1. Confirm you approved the requested scopes in the Cloudflare consent screen.
  2. Try Disconnect, then Connect with Cloudflare again.
  3. If your Cloudflare user cannot authorize the account, ask an account admin to complete the connect flow.
API token credential shows Error
  1. Confirm the Account ID matches the account the token was created for.
  2. Confirm the token includes at least the core Read permissions you expect (Account Settings, Zone, Zone Settings, DNS).
  3. Confirm the token is not expired or revoked in the Cloudflare dashboard.
Incomplete inventory after connect Allow a few minutes for the initial inventory scan. If some families are missing, confirm the authorized account (or token) includes the matching Read permissions. Subset and zone-scoped grants are supported; denied families soft-fail rather than failing the whole extract.

​
Try Anyshift

Create an account

Request a demo

See Anyshift Root Cause Analysis in action