Skip to content
Docs
Infrastructure & monitoring

Cloudflare

Let hires read and change DNS records, clear the cache, check traffic, and see Workers and Pages deployments, on the zones you choose.

Explore 11 actions and their permissionsExact inputs, sign-in scopes, access limits and approval rules.

With Cloudflare, a hire can:

  • list your zones (domains) and their DNS records,
  • add, change and delete DNS records,
  • clear the cache for some URLs, hostnames, prefixes or tags, or for a whole zone,
  • see a zone's traffic over the last day, 3 days, week or 30 days: requests, how much came from the cache, bandwidth, threats and page views, day by day,
  • list Workers and their recent deployments, and Pages projects and their deployments (branch, commit, status).

It never sees your Pages projects' environment variables.

1. Make an API token in Cloudflare

The quickest way: open this token template. It has the permissions below already ticked: limit Zone Resources to the zones hires work on, untick what they don't need, then Continue to summary → Create Token.

  1. In Cloudflare, open My Profile → API Tokens and click Create Token, then Create Custom Token. Name it Roster.
  2. Give it only what hires need:
    • Zone → Zone → Read, and Zone → Analytics → Read for traffic,
    • Zone → DNS → Read (or Edit, for hires that change records),
    • Zone → Cache Purge → Purge, for hires that clear the cache,
    • Account → Workers Scripts → Read and Account → Cloudflare Pages → Read, for deployments.
  3. Under Zone Resources, pick only the zones hires work on.
  4. Create it and copy the token.

2. Connect it in Roster

  1. Open Integrations → Tools → Add a tool, search for Cloudflare and choose it.
  2. API token: paste the token.
  3. Account ID (only for Workers and Pages, and only if the token reaches more than one account): from your account's home page in Cloudflare.
  4. Click Connect.

Roster checks the key when you click Connect. Once it's accepted, the connection shows Connected as the Cloudflare account the token reaches, and how many zones. If it's refused, Roster says what to fix (a mistyped key, a missing permission) and saves nothing.

3. Give hires access

On the hire's Tools tab, click Give access on Cloudflare:

  • Read only: zones, DNS records, traffic, Workers and Pages.
  • Read and write: also add, change and delete DNS records, and clear the cache.
  • Zones: domains like example.com, one per line. Every DNS change, cache clear and traffic report is for one of these, and a record's name can't leave its zone (www means www.example.com). Leave it empty for every zone the token reaches.
  • Workers and Pages projects: their names, one per line. Leave it empty for all.

Changes that are hard to take back

Deleting a DNS record makes whatever used that name stop working, and clearing a whole zone's cache sends every visitor to your servers at once. Both wait for a person's approval: the hire asks in the thread ("Delete the A record www.example.com"), and when the approver says yes, Roster does exactly that, once. Adding and changing records, and clearing the cache for some URLs, go ahead without asking; to change that for a hire, use When it asks first on its Tools tab.

If something goes wrong

  • "Didn't accept the connection's credential": the token was deleted or has expired.
  • "Unauthorized to access requested resource": the token lacks a permission (often DNS Edit or Cache Purge), or doesn't cover that zone.
  • "Someone needs to set the Account ID": the token reaches several accounts; add the one to use on the connection.

Tools and permissions reference

This reference is built from the same definitions Roster uses to connect Cloudflare and give hires access. It updates with each release.

Authentication and requested permissions

The account or app you connect sets the outer limit. Each hire's access can narrow it further. Connecting a tool gives it to no hire until you give access on that hire's Tools tab.

API key or access token

In Cloudflare: My Profile → API Tokens → Create Token, with only the permissions hires need, for only the zones they work on.

When making a key, use these permissions from the connection guide:

  • Zone: Read
  • DNS: Edit
  • Cache Purge: Purge
  • Analytics: Read
  • Workers Scripts: Read
  • Cloudflare Pages: Read

Connection fields

Cloudflare connection fields
FieldWhat to provide
API token
token
Required · sealed secret		In Cloudflare: My Profile → API Tokens → Create Token, with only the permissions hires need, for only the zones they work on.
Account ID
accountId
Optional		For Workers and Pages: from the dashboard's account home (Account ID). Leave empty when the token reaches one account.

Per-hire limits

Read-only hires receive only actions that read. Read-and-write access also allows actions that change things, where the connection itself permits them. An empty resource allowlist usually means everything the connected account can reach; each field below explains its meaning.

Cloudflare per-hire limits
FieldWhat to provide
Zones
zones
Optional		Domains (zones) like example.com, or zone IDs, one per line. Leave empty for every zone the token reaches.
Workers and Pages projects
projects
Optional		Worker and Pages project names, one per line. Leave empty for all.

Actions

11 actions: 7 only read and 4 change something. A read action may still need approval when your workspace or hire is set to ask. A locked approval requirement always applies.

11 of 11 actions. Open an action for its arguments and full input schema.

list_zonesRead only

The zones (domains) this hire can work on.

Approval: Uses your workspace and hire approval settings.

This action takes no arguments.

Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
list_dns_recordsRead only

A zone's DNS records, optionally of one type or with part of a name.

Approval: Uses your workspace and hire approval settings.

Arguments for list_dns_records
ArgumentTypeDetails
zoneRequiredstringthe zone, e.g. example.com
typeOptional"A" | "AAAA" | "CNAME" | "TXT" | "MX" | "NS" | "SRV" | "CAA" | "PTR" | "HTTPS" | "SVCB"See input schema below.
nameOptionalstringpart of the record's name
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "zone": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "the zone, e.g. example.com"
    },
    "type": {
      "type": "string",
      "enum": [
        "A",
        "AAAA",
        "CNAME",
        "TXT",
        "MX",
        "NS",
        "SRV",
        "CAA",
        "PTR",
        "HTTPS",
        "SVCB"
      ]
    },
    "name": {
      "description": "part of the record's name",
      "type": "string",
      "maxLength": 253
    }
  },
  "required": [
    "zone"
  ]
}
create_dns_recordRead and write

Add a DNS record. Names may be short ("www", "@" for the zone itself). Proxied (orange cloud) only for A, AAAA and CNAME.

Approval: Uses your workspace and hire approval settings.

Arguments for create_dns_record
ArgumentTypeDetails
zoneRequiredstringthe zone, e.g. example.com
typeRequired"A" | "AAAA" | "CNAME" | "TXT" | "MX" | "NS"See input schema below.
nameRequiredstringSee input schema below.
contentRequiredstringthe address, target or text
ttlOptionalintegerSee input schema below.Default: 1
proxiedOptionalbooleanSee input schema below.Default: false
priorityOptionalintegerfor MX
commentOptionalstringSee input schema below.
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "zone": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "the zone, e.g. example.com"
    },
    "type": {
      "type": "string",
      "enum": [
        "A",
        "AAAA",
        "CNAME",
        "TXT",
        "MX",
        "NS"
      ]
    },
    "name": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253
    },
    "content": {
      "type": "string",
      "minLength": 1,
      "maxLength": 4096,
      "description": "the address, target or text"
    },
    "ttl": {
      "default": 1,
      "type": "integer",
      "minimum": -9007199254740991,
      "maximum": 9007199254740991
    },
    "proxied": {
      "default": false,
      "type": "boolean"
    },
    "priority": {
      "description": "for MX",
      "type": "integer",
      "minimum": 0,
      "maximum": 65535
    },
    "comment": {
      "type": "string",
      "maxLength": 100
    }
  },
  "required": [
    "zone",
    "type",
    "name",
    "content"
  ]
}
update_dns_recordRead and write

Change a DNS record's content, TTL, proxying or comment (by its ID from list_dns_records).

Approval: Uses your workspace and hire approval settings.

Arguments for update_dns_record
ArgumentTypeDetails
zoneRequiredstringthe zone, e.g. example.com
recordRequiredstringSee input schema below.
contentOptionalstringSee input schema below.
ttlOptionalintegerSee input schema below.
proxiedOptionalbooleanSee input schema below.
commentOptionalstringSee input schema below.
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "zone": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "the zone, e.g. example.com"
    },
    "record": {
      "type": "string",
      "pattern": "^[a-f0-9]{32}$"
    },
    "content": {
      "type": "string",
      "minLength": 1,
      "maxLength": 4096
    },
    "ttl": {
      "type": "integer",
      "minimum": -9007199254740991,
      "maximum": 9007199254740991
    },
    "proxied": {
      "type": "boolean"
    },
    "comment": {
      "type": "string",
      "maxLength": 100
    }
  },
  "required": [
    "zone",
    "record"
  ]
}
delete_dns_recordRead and write

Delete a DNS record (by its ID and name from list_dns_records). Whatever used that name stops resolving. It waits for a person's approval: Roster asks in the thread and deletes it, once, when they approve.

Approval: Always asks for approval.

Arguments for delete_dns_record
ArgumentTypeDetails
zoneRequiredstringthe zone, e.g. example.com
recordRequiredstringSee input schema below.
nameRequiredstringthe record's name, as list_dns_records shows it; checked
typeRequired"A" | "AAAA" | "CNAME" | "TXT" | "MX" | "NS" | "SRV" | "CAA" | "PTR" | "HTTPS" | "SVCB"the record's type; checked
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "zone": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "the zone, e.g. example.com"
    },
    "record": {
      "type": "string",
      "pattern": "^[a-f0-9]{32}$"
    },
    "name": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "the record's name, as list_dns_records shows it; checked"
    },
    "type": {
      "type": "string",
      "enum": [
        "A",
        "AAAA",
        "CNAME",
        "TXT",
        "MX",
        "NS",
        "SRV",
        "CAA",
        "PTR",
        "HTTPS",
        "SVCB"
      ],
      "description": "the record's type; checked"
    }
  },
  "required": [
    "zone",
    "record",
    "name",
    "type"
  ]
}
purge_cacheRead and write

Clear Cloudflare's cache for some URLs (up to 100), hostnames, URL prefixes or cache tags in a zone. Purging everything makes every visitor hit your servers at once: only when asked to.

Approval: when it clears a whole zone's cache.

Arguments for purge_cache
ArgumentTypeDetails
zoneRequiredstringthe zone, e.g. example.com
urlsOptionalstring[]See input schema below.Default: []
hostsOptionalstring[]See input schema below.Default: []
prefixesOptionalstring[]like www.example.com/images, without https://Default: []
tagsOptionalstring[]See input schema below.Default: []
everythingOptionalbooleanSee input schema below.Default: false
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "zone": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "the zone, e.g. example.com"
    },
    "urls": {
      "default": [],
      "maxItems": 100,
      "type": "array",
      "items": {
        "type": "string",
        "format": "uri"
      }
    },
    "hosts": {
      "default": [],
      "maxItems": 30,
      "type": "array",
      "items": {
        "type": "string",
        "maxLength": 253
      }
    },
    "prefixes": {
      "default": [],
      "description": "like www.example.com/images, without https://",
      "maxItems": 30,
      "type": "array",
      "items": {
        "type": "string",
        "maxLength": 1024
      }
    },
    "tags": {
      "default": [],
      "maxItems": 30,
      "type": "array",
      "items": {
        "type": "string",
        "maxLength": 1024
      }
    },
    "everything": {
      "default": false,
      "type": "boolean"
    }
  },
  "required": [
    "zone"
  ]
}
zone_analyticsRead only

A zone's traffic over the last hours or days: requests, how much came from cache, bandwidth, threats and page views, per day.

Approval: Uses your workspace and hire approval settings.

Arguments for zone_analytics
ArgumentTypeDetails
zoneRequiredstringthe zone, e.g. example.com
periodOptional"24h" | "3d" | "7d" | "30d"See input schema below.Default: "24h"
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "zone": {
      "type": "string",
      "minLength": 1,
      "maxLength": 253,
      "description": "the zone, e.g. example.com"
    },
    "period": {
      "default": "24h",
      "type": "string",
      "enum": [
        "24h",
        "3d",
        "7d",
        "30d"
      ]
    }
  },
  "required": [
    "zone"
  ]
}
list_workersRead only

The account's Workers, with when each was last changed.

Approval: Uses your workspace and hire approval settings.

This action takes no arguments.

Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
list_worker_deploymentsRead only

A Worker's recent deployments: when, by whom, which versions at what share, and the message.

Approval: Uses your workspace and hire approval settings.

Arguments for list_worker_deployments
ArgumentTypeDetails
workerRequiredstringSee input schema below.
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "worker": {
      "type": "string",
      "pattern": "^[a-z0-9_-]{1,63}$"
    }
  },
  "required": [
    "worker"
  ]
}
list_pages_projectsRead only

The account's Pages projects, with their domains and production branch.

Approval: Uses your workspace and hire approval settings.

This action takes no arguments.

Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
list_pages_deploymentsRead only

A Pages project's recent deployments: environment, status, branch and commit.

Approval: Uses your workspace and hire approval settings.

Arguments for list_pages_deployments
ArgumentTypeDetails
projectRequiredstringSee input schema below.
environmentOptional"production" | "preview"See input schema below.
Full input schema (JSON)
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {
    "project": {
      "type": "string",
      "pattern": "^[a-z0-9_-]{1,63}$"
    },
    "environment": {
      "type": "string",
      "enum": [
        "production",
        "preview"
      ]
    }
  },
  "required": [
    "project"
  ]
}

Watches and incoming events

  • No built-in watch is declared. Give a hire a scheduled responsibility if it should check this service regularly.
  • No incoming webhook handler is declared for this integration.

Limits and troubleshooting

  • Permission errors: check both the connected account's rights and the hire's resource and read/write limits.
  • Expired or revoked access: reconnect or replace the key on the connection.
  • Rate limits and unavailable services can interrupt work. The hire's timecard records the outcome.
  • The action schema describes accepted inputs. It does not grant additional access or bypass approvals.

Service documentation · Integration source reference

CircleCI

Pipelines, failed jobs and their logs.

Datadog

Metrics, logs, traces, monitors and incidents.

On this page

1. Make an API token in Cloudflare2. Connect it in Roster3. Give hires accessIf something goes wrongTools and permissions reference