Cloudflare

Restrict how your agents can use Cloudflare.

Require agents to confirm every DNS change, or set up custom rules for automation.

CloudflarePreview deployer · acme.devkc_…5b10
PermissionAccessZonesOnly when
Zone · Read
zone.read
Allowedacme.devAny request
DNS records · Read
dns_records.read
Allowedacme.devAny request
DNS records · Create
dns_records.create
Allowedacme.dev
body.type = CNAME
body.name starts with preview-
DNS records · Create
dns_records.create
Ask meWaits up to 24 hoursacme.devAny request
DNS records · Update
dns_records.update
Ask meWaits up to 24 hoursacme.devAny request
DNS records · Delete
dns_records.delete
Ask meWaits up to 24 hoursacme.devAny request
Pages deployments · Deploy
deployments.create
AllowedWhole account
path.project = docs
Allowed goes straight throughAsk me waits for your confirmation
What you can control

Permissions

Each row of a key's Cloudflare access is one of these, set to Allowed or Ask me.

PermissionName in the API
Zone · Readzone.read
Zone · Check activationzone.activation_check
DNS records · Readdns_records.read
DNS records · Createdns_records.create
DNS records · Updatedns_records.update
DNS records · Deletedns_records.delete
DNS records · Change manydns_records.batch
Cache · Purgecache.purge
Zone settings · Readsettings.read
Zone settings · Changesettings.update
Zones · Listzones.list
Zones · Createzones.create
Pages projects · Listpages.list
Pages projects · Readpages.read
Pages projects · Createpages.create
Pages projects · Changepages.update
Pages projects · Deletepages.delete
Pages deployments · Deploydeployments.create
Pages deployments · Retrydeployments.retry
Pages deployments · Roll backdeployments.rollback
Pages deployments · Deletedeployments.delete
Custom rule: a method and a path that you choose.

Give your agents Cloudflare keys that fit.