Skip to main content
Connect Cloudflare so Enclave can see your DNS, which hostnames Cloudflare proxies, and the Workers and Pages projects behind them. Access is read-only.

​
Before you start

  • You need the Owner or Admin role in Enclave.
  • In Cloudflare, you need to be a Super Administrator or have API Token Provisioning to create account API tokens.

​
Create the token

1

Create a custom token

In Cloudflare, go to Manage Account → Account API Tokens and create a custom token. Set each permission below to Read.
2

Create it

Click Continue to summary, then Create Token.
3

Paste it in Enclave

Open Settings → Integrations and click Connect next to Cloudflare. Paste the token. Enclave checks it and adds every Cloudflare account the token can read.
If a permission is missing, Enclave names it so you can edit the token. Enclave stores the token encrypted.

​
What Enclave reads

  • Zones and DNS records, including which records Cloudflare proxies
  • Worker routes and origin rules
  • Workers and their custom domains
  • Pages projects
  • Workers Builds triggers, which link a Worker to its repository
In Coverage, proxied records show a Proxied by Cloudflare badge. Enclave doesn’t read Transform Rules, Snippets, or Cloudflare Access. A Worker deployed with Wrangler and no Workers Builds trigger has no repository link.

​
Manage the connection

Open Settings → Integrations → Cloudflare.
  • Refresh status checks the token again. An account shows Reconnect needed if the token was revoked, expired, or lost access. Paste a new token to fix it.
  • Remove removes the account and its zones, Workers, and Pages projects from Enclave. Enclave can’t revoke the token, so revoke it in Cloudflare too, unless another connected account uses it.