Skip to main content
Connecting Cloudflare to NOFire AI brings your edge configuration into the context graph, so an investigation can follow a request from DNS and the edge down to the workloads behind it. NOFire AI discovers your account, its zones, and the DNS records on each zone, and links a CNAME to the record it points at. NOFire AI authenticates with a scoped, read-only Cloudflare API token. NOFire AI never writes to or modifies Cloudflare configuration.

​
Prerequisites

  • A Cloudflare account, and its account ID.
  • Permission to create API tokens on that account (Super Administrator, or a role with API Tokens Write).
Use a scoped API token, not a Global API Key. Global API Keys carry full read-write access to everything in the account, while NOFire AI only needs the read permissions listed below.

​
Step 1: Create a read-only API token

Create the token in the Cloudflare dashboard

  1. Open My Profile → API Tokens and click Create Token.
  2. Scroll to the bottom and click Get started under Custom token.
  3. Name the token (for example nofireai-readonly).
  4. Add the permissions in the table below. Each row is one Permissions entry: pick the group (Account or Zone), the permission, and Read.
  5. Under Account Resources, select Include and the account you are connecting.
  6. Under Zone Resources, select Include → All zones from an account and pick the same account. To limit the token to specific zones, select Include → Specific zone instead and add one entry per zone.
  7. Leave Client IP Address Filtering empty unless you have an allowlist requirement, and leave TTL unset so the token does not expire mid-investigation.
  8. Click Continue to summary, review the permission list, then click Create Token.
  9. Copy the token value. Cloudflare shows it only once.

​
Token permissions

Cloudflare Page Rules are not covered. The Page Rules API does not accept API-token authentication, so no scoped token can read them.
A healthy token returns "status": "active". Confirm it can also list zones, which is the first read NOFire AI makes:

​
Step 2: Find your account ID and zone IDs

From the Cloudflare dashboard

  • Account ID: open any zone’s Overview page. The account ID is in the right-hand API panel, and is also the 32-character hex string in the dashboard URL, https://dash.cloudflare.com/<account-id>/....
  • Zone ID: on the same Overview page, directly above the account ID. You only need zone IDs if you want to limit discovery to specific zones.

​
Step 3: Add the Cloudflare connection to NOFire AI

Navigate to the Connections tab

Once the connection is saved, NOFire AI discovers the account, its zones, and the DNS records on each zone, then sets the connection status to READY. You can watch the status on the Connections dashboard.

​
What NOFire AI discovers

Cloudflare entities join the same context graph as your Kubernetes state from NOFire Edge and your connected cloud accounts, so a DNS record can be traced to the Ingress, Service, or load balancer serving the same hostname.

​
Troubleshooting

The error names the exact permission the token is missing, for example DNS:Read. Edit the token in the Cloudflare dashboard, add that permission as Read, and save the connection again. Editing a token keeps its value, so you do not need to re-enter it.
An account with no zones looks the same as a correct account that has nothing in it yet, so the connection test passes. The usual cause is a mistyped account ID that Cloudflare’s API still accepts. Confirm the ID returns your zones with the curl command in Step 2.
The token is scoped to a subset of your zones. Edit the token’s Zone Resources and set it to All zones from an account, or add an entry per zone you want discovered.
NOFire AI paginates through zones and records and backs off when Cloudflare rate-limits it, so accounts with many zones take longer on the first pass. Set Zone IDs to the zones you actually investigate to keep discovery focused.

​
Multiple accounts

Add one connection per Cloudflare account, each with a token scoped to that account.