> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enclave.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Enclave in these docs is the code and cloud security platform at enclave.ai. It is not Open Enclave, Intel SGX or other hardware enclaves, or enclave.gg.
> People use Enclave in the web app at https://app.enclave.ai or the desktop app. These docs describe no public Enclave API or CLI, so don't invent endpoints, commands, or config files.
> Connecting an integration needs a person to sign in and approve access in a browser. Tell the user the exact step to take instead of saying you completed it.

# Cloudflare

> Connect Cloudflare with a read-only API token so Enclave can map your zones, Workers, and Pages projects.

Connect Cloudflare so Enclave can see your DNS, which hostnames Cloudflare proxies, and the Workers and Pages projects behind them. Access is read-only.

## Before you start

* You need the **Owner** or **Admin** role in Enclave.
* In Cloudflare, you need to be a **Super Administrator** or have **API Token Provisioning** to create account API tokens.

## Create the token

**1. Create a custom token**

In Cloudflare, go to **Manage Account → Account API Tokens** and create a custom token. Set each permission below to **Read**.

**2. Create it**

Click **Continue to summary**, then **Create Token**.

**3. Paste it in Enclave**

Open **Settings → Integrations** and click **Connect** next to **Cloudflare**. Paste the token. Enclave checks it and adds every Cloudflare account the token can read.

| Section | Permission | Scope |
| - | - | - |
| Account & Billing | Account Settings | Account |
| Account & Billing | Account API Tokens | Account |
| DNS & Zones | Zone | Zone |
| DNS & Zones | DNS | Zone |
| Developer Platform | Worker Routes | Zone |
| Developer Platform | Workers Scripts | Account |
| Developer Platform | Pages | Account |
| Developer Platform | Workers CI | Account |
| Rules & Configuration | Origin | Zone |

If a permission is missing, Enclave names it so you can edit the token. Enclave stores the token encrypted.

## What Enclave reads

* Zones and DNS records, including which records Cloudflare proxies
* Worker routes and origin rules
* Workers and their custom domains
* Pages projects
* Workers Builds triggers, which link a Worker to its repository

In Coverage, proxied records show a **Proxied by Cloudflare** badge.

Enclave doesn't read Transform Rules, Snippets, or Cloudflare Access. A Worker deployed with Wrangler and no Workers Builds trigger has no repository link.

## Manage the connection

Open **Settings → Integrations → Cloudflare**.

* **Refresh status** checks the token again. An account shows **Reconnect needed** if the token was revoked, expired, or lost access. Paste a new token to fix it.
* **Remove** removes the account and its zones, Workers, and Pages projects from Enclave. Enclave can't revoke the token, so revoke it in Cloudflare too, unless another connected account uses it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.