> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nofire.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare

> Connect your Cloudflare account to NOFire AI

Connecting Cloudflare to NOFire AI brings your edge configuration into the context graph, so an investigation can follow a request from DNS and the edge down to the workloads behind it. NOFire AI discovers your account, its zones, and the DNS records on each zone, and links a CNAME to the record it points at.

NOFire AI authenticates with a scoped, read-only [Cloudflare API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/). NOFire AI never writes to or modifies Cloudflare configuration.

## Prerequisites

* A Cloudflare account, and its **account ID**.
* Permission to create API tokens on that account (**Super Administrator**, or a role with **API Tokens Write**).

<Note>
  Use a scoped API token, not a Global API Key. Global API Keys carry full read-write access to everything in the account, while NOFire AI only needs the read permissions listed below.
</Note>

## Step 1: Create a read-only API token

<Accordion title="Create the token in the Cloudflare dashboard" defaultOpen>
  1. Open [**My Profile → API Tokens**](https://dash.cloudflare.com/profile/api-tokens) and click **Create Token**.
  2. Scroll to the bottom and click **Get started** under **Custom token**.
  3. Name the token (for example `nofireai-readonly`).
  4. Add the permissions in the table below. Each row is one **Permissions** entry: pick the group (Account or Zone), the permission, and **Read**.
  5. Under **Account Resources**, select **Include** and the account you are connecting.
  6. Under **Zone Resources**, select **Include → All zones from an account** and pick the same account. To limit the token to specific zones, select **Include → Specific zone** instead and add one entry per zone.
  7. Leave **Client IP Address Filtering** empty unless you have an allowlist requirement, and leave **TTL** unset so the token does not expire mid-investigation.
  8. Click **Continue to summary**, review the permission list, then click **Create Token**.
  9. Copy the token value. Cloudflare shows it only once.
</Accordion>

### Token permissions

| Group   | Permission             | Access | What it covers                                                                  |
| ------- | ---------------------- | ------ | ------------------------------------------------------------------------------- |
| Zone    | **Zone**               | Read   | The zones on the account. Required for any discovery to run.                    |
| Zone    | **DNS**                | Read   | The DNS records on each zone                                                    |
| Zone    | **Zone Settings**      | Read   | Per-zone settings                                                               |
| Zone    | **Cache Rules**        | Read   | Cache configuration                                                             |
| Zone    | **Zone WAF**           | Read   | Managed and custom WAF rules, and HTTP (layer 7) DDoS protection                |
| Account | **Account Settings**   | Read   | The account itself, and account-level WAF and network (layer 4) DDoS protection |
| Account | **Turnstile**          | Read   | Turnstile widgets                                                               |
| Account | **Workers R2 Storage** | Read   | R2 buckets                                                                      |

<Note>
  Cloudflare **Page Rules** are not covered. The Page Rules API does not accept API-token authentication, so no scoped token can read them.
</Note>

<Accordion title="Verify the token before you use it" defaultOpen="false">
  ```bash theme={null}
  export CF_API_TOKEN="<your token>"
  export CF_ACCOUNT_ID="<your account ID>"

  curl -s https://api.cloudflare.com/client/v4/user/tokens/verify \
    -H "Authorization: Bearer ${CF_API_TOKEN}"
  ```

  A healthy token returns `"status": "active"`. Confirm it can also list zones, which is the first read NOFire AI makes:

  ```bash theme={null}
  curl -s "https://api.cloudflare.com/client/v4/zones?account.id=${CF_ACCOUNT_ID}" \
    -H "Authorization: Bearer ${CF_API_TOKEN}" \
    | jq '.result[] | {id, name}'
  ```
</Accordion>

## Step 2: Find your account ID and zone IDs

<Accordion title="From the Cloudflare dashboard" defaultOpen>
  * **Account ID**: open any zone's **Overview** page. The account ID is in the right-hand **API** panel, and is also the 32-character hex string in the dashboard URL, `https://dash.cloudflare.com/<account-id>/...`.
  * **Zone ID**: on the same **Overview** page, directly above the account ID. You only need zone IDs if you want to limit discovery to specific zones.
</Accordion>

<Accordion title="From the API" defaultOpen="false">
  ```bash theme={null}
  # Account IDs
  curl -s https://api.cloudflare.com/client/v4/accounts \
    -H "Authorization: Bearer ${CF_API_TOKEN}" \
    | jq '.result[] | {id, name}'

  # Zone IDs on an account
  curl -s "https://api.cloudflare.com/client/v4/zones?account.id=${CF_ACCOUNT_ID}" \
    -H "Authorization: Bearer ${CF_API_TOKEN}" \
    | jq '.result[] | {id, name}'
  ```
</Accordion>

## Step 3: Add the Cloudflare connection to NOFire AI

<Accordion title="Navigate to the Connections tab" defaultOpen>
  1. In the NOFire AI dashboard, go to **Connections**.
  2. Click **Connect** on the **Cloudflare** card.
  3. Enter your connection details:
     * **Name**: a descriptive label (for example `production-cloudflare`)
     * **Cloudflare Account ID**: the account to discover
     * **API Token**: the token from Step 1
     * **Zone IDs (Optional)**: a comma-separated list of zone IDs. Leave it empty to discover every zone the token can see.
  4. Click **Save**.

  NOFire AI tests the token before saving the connection. The token is stored encrypted and is never displayed again.
</Accordion>

Once the connection is saved, NOFire AI discovers the account, its zones, and the DNS records on each zone, then sets the connection status to **READY**. You can watch the status on the Connections dashboard.

## What NOFire AI discovers

| Entity         | Details                                                                                                                                                                                                                                    |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Account**    | One per connection, named by the configured account ID                                                                                                                                                                                     |
| **Zone**       | One per zone the token can see, limited to your configured zone IDs when you set them                                                                                                                                                      |
| **DNS record** | One per record on each zone, named `<type> <name>` (for example `A api.example.com`), carrying the record type, content, proxied flag, TTL, and comment. A CNAME is linked to the record it points at when that record is also discovered. |

Cloudflare entities join the same context graph as your Kubernetes state from [NOFire Edge](/edge/introduction) and your connected cloud accounts, so a DNS record can be traced to the Ingress, Service, or load balancer serving the same hostname.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Connection test fails naming a specific permission">
    The error names the exact permission the token is missing, for example `DNS:Read`. Edit the token in the Cloudflare dashboard, add that permission as **Read**, and save the connection again. Editing a token keeps its value, so you do not need to re-enter it.
  </Accordion>

  <Accordion title="Connection saves as healthy but the graph stays empty">
    An account with no zones looks the same as a correct account that has nothing in it yet, so the connection test passes. The usual cause is a mistyped account ID that Cloudflare's API still accepts. Confirm the ID returns your zones with the `curl` command in Step 2.
  </Accordion>

  <Accordion title="Some zones are missing their DNS records">
    The token is scoped to a subset of your zones. Edit the token's **Zone Resources** and set it to **All zones from an account**, or add an entry per zone you want discovered.
  </Accordion>

  <Accordion title="Discovery is slow on a large account">
    NOFire AI paginates through zones and records and backs off when Cloudflare rate-limits it, so accounts with many zones take longer on the first pass. Set **Zone IDs** to the zones you actually investigate to keep discovery focused.
  </Accordion>
</AccordionGroup>

## Multiple accounts

Add one connection per Cloudflare account, each with a token scoped to that account.