How to get a Cloudflare API token

DNSense talks to Cloudflare with an API token. Make a scoped one. The legacy Global API key also works, but it carries full access to every account you belong to, and a leaked copy is a much bigger problem than a leaked token.

What the token needs

• Zone: Read so DNSense can list your zones.
• DNS: Edit so it can change records.
• Domain: Read, only if you also want to see domains registered at Cloudflare Registrar.

Create the token

1. Open the Cloudflare dashboard and go to My Profile > API Tokens. Account owners can create an account-owned token under Manage Account instead, which is not tied to one person's login.
2. Click Create Token. Start from the Edit zone DNS template, or pick Create Custom Token.
3. Name it something you will recognise later, like dnsense.
4. Check the permission list. Add Zone > Zone > Read if the template left it out.
5. Under Zone Resources, choose the zones DNSense may touch. All zones is the simplest. A single zone works too, but DNSense will only see that one.

6. Leave the client IP filter empty unless you know which address DNSense connects from. A filter that does not match makes every call fail.
7. Continue to the summary and read it once.

8. Click Create Token.

Copy it now

Cloudflare shows the token once. Copy it before closing the page. The screen also has a curl command that tests the token, which is worth running.

Connect it to DNSense

Add a connection, choose Cloudflare and pick the API token option. Paste the token. The Account ID field is optional; leave it empty unless you want to limit DNSense to one account. If you lose the token later, create a new one and replace the credentials on the existing connection. No need to delete it.