> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anyshift.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare Integration

> Connect Cloudflare so Annie can inventory DNS, zones, certificates, WAF, load balancers, Workers, tunnels, and Access via OAuth/OIDC or an API token.

Connect your Cloudflare account to Annie to inventory DNS records, zones, certificates, WAF, load balancers, Workers, tunnels, Access, and other edge configuration. Annie uses this data during investigations to map hostnames to infrastructure and surface edge-related changes.

<Info>
  **Security first**: Anyshift only requests read-only access. Prefer **Connect with Cloudflare** (OAuth / OIDC). An Account API token is available as a fallback. Do not grant Edit or Write permissions.
</Info>

# Setup Guide

You can connect Cloudflare in either of two ways. OAuth / OIDC is recommended.

Go to [Integrations → Cloudflare](https://app.anyshift.io/integrations/cloudflare/credentials) in Anyshift to start.

<Tabs>
  <Tab title="OAuth / OIDC (recommended)">
    ## Connect with Cloudflare (OAuth / OIDC)

    Use OAuth when you want a one-click authorize flow without pasting a long-lived API token.

    1. Open **Integrations → Cloudflare**.
    2. Click **Connect with Cloudflare**.
    3. Sign in to Cloudflare if prompted, pick the account to authorize, and approve the read-only scopes Anyshift requests.
    4. You return to Anyshift. The page shows the connected Cloudflare account.

    Anyshift stores the OAuth tokens encrypted and refreshes them automatically. If the connection status shows that re-authorization is required, click **Reconnect** and approve again.

    ### OAuth scopes (recommended full read set)

    Anyshift requests these read-only scopes for full inventory. Approving a subset (or using a zone-scoped grant) still works; missing scopes soft-fail and those inventory families may be incomplete.

    | Scope ID                                 | Purpose                                       |
    | ---------------------------------------- | --------------------------------------------- |
    | `account-settings.read`                  | Account metadata                              |
    | `zone.read`                              | Zone inventory                                |
    | `zone-settings.read`                     | Zone settings (including SSL mode)            |
    | `dns.read`                               | DNS records for hostname mapping              |
    | `ssl-and-certificates.read`              | Certificate packs, custom hostnames           |
    | `account-ssl-and-certificates.read`      | Origin CA certificates                        |
    | `zone-waf.read`                          | Zone WAF / ruleset phases                     |
    | `firewall-services.read`                 | Zone firewall surfaces                        |
    | `account-rulesets.read`                  | Account rulesets                              |
    | `load-balancing-monitors-and-pools.read` | Pools, origins, monitors                      |
    | `load-balancers.read`                    | Zone load balancers                           |
    | `workers-scripts.read`                   | Workers scripts                               |
    | `workers-routes.read`                    | Worker routes                                 |
    | `argotunnel.read`                        | Cloudflare Tunnels                            |
    | `access.read`                            | Access applications and policies              |
    | `offline_access`                         | Refresh tokens so the connection stays active |
  </Tab>

  <Tab title="API token">
    ## Connect with an API token

    Use an Account API token when OAuth is unavailable in your workspace, or when you prefer a manually created token.

    1. In the [Cloudflare dashboard](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/), create an **Account API token** with the recommended Read permissions below.
    2. In Anyshift, open **Integrations → Cloudflare**.
    3. Click **New credential** (or **Add API token credentials** if OAuth is also enabled).
    4. Enter:
       * **Name**: a label for this connection (for example `Production Cloudflare`)
       * **Account ID**: from the Cloudflare dashboard overview for that account
       * **API token**: the token value (stored encrypted; not shown again after save)
    5. Click **Save**.

    ### API token permissions (recommended full read set)

    Grant these read-only permissions (equivalent to the OAuth scopes above) for full inventory. A subset or zone-scoped token is allowed; missing permissions soft-fail and inventory for those families may be incomplete.

    | Permission                              | Scope   |
    | --------------------------------------- | ------- |
    | Account Settings Read                   | Account |
    | Zone Read                               | Zone    |
    | Zone Settings Read                      | Zone    |
    | DNS Read                                | Zone    |
    | SSL and Certificates Read               | Zone    |
    | Account: SSL and Certificates Read      | Account |
    | Zone WAF Read                           | Zone    |
    | Firewall Services Read                  | Zone    |
    | Account Rulesets Read                   | Account |
    | Load Balancing: Monitors and Pools Read | Account |
    | Load Balancers Read                     | Zone    |
    | Workers Scripts Read                    | Account |
    | Workers Routes Read                     | Zone    |
    | Cloudflare Tunnel Read                  | Account |
    | Access: Apps and Policies Read          | Account |

    **Optional** (omit family when missing; not treated as a partial failure): Account Logs Read; Memberships Read (user tokens).

    Do not grant Edit or Write.
  </Tab>
</Tabs>

# What Annie uses this for

Once connected, Annie can:

* List zones and DNS records for hostname-to-resource mapping
* Read zone settings that affect edge behavior (for example SSL mode)
* Inventory certificates, WAF/firewall rulesets, load balancers, Workers, tunnels, and Access when those Read permissions are present
* Correlate Cloudflare configuration with your broader infrastructure graph during investigations

# Troubleshooting

**OAuth connect fails or returns to Anyshift with an error**

1. Confirm you approved the requested scopes in the Cloudflare consent screen.
2. Try **Disconnect**, then **Connect with Cloudflare** again.
3. If your Cloudflare user cannot authorize the account, ask an account admin to complete the connect flow.

**API token credential shows Error**

1. Confirm the Account ID matches the account the token was created for.
2. Confirm the token includes at least the core Read permissions you expect (Account Settings, Zone, Zone Settings, DNS).
3. Confirm the token is not expired or revoked in the Cloudflare dashboard.

**Incomplete inventory after connect**

Allow a few minutes for the initial inventory scan. If some families are missing, confirm the authorized account (or token) includes the matching Read permissions. Subset and zone-scoped grants are supported; denied families soft-fail rather than failing the whole extract.

# Try Anyshift

<CardGroup cols={2}>
  <Card title="Create an account" icon="user-plus" href="https://app.anyshift.io/" />

  <Card title="Request a demo" icon="phone" href="https://calendly.com/d/cr9z-6g6-6g9/meet-with-anyshift">
    See Anyshift Root Cause Analysis in action
  </Card>
</CardGroup>