---
title: "How to get a Cloudflare API token"
description: "Create a scoped Cloudflare API token with Zone Read and DNS Edit, and connect it to DNSense without handing over your global key."
canonical_url: "https://dnsense.io/learn/how-to-get-a-cloudflare-api-token"
---

> Index of every page on this site: [llms.txt](https://dnsense.io/llms.txt)

DNSense talks to Cloudflare with an API token. Make a scoped one. The legacy Global API key also works, but it carries full access to every account you belong to, and a leaked copy is a much bigger problem than a leaked token.

## What the token needs

- **Zone: Read** so DNSense can list your zones.
- **DNS: Edit** so it can change records.
- **Domain: Read**, only if you also want to see domains registered at Cloudflare Registrar.

## Create the token

1. Open the Cloudflare dashboard and go to **My Profile > API Tokens**. Account owners can create an account-owned token under **Manage Account** instead, which is not tied to one person's login.
2. Click **Create Token**. Start from the **Edit zone DNS** template, or pick **Create Custom Token**.
3. Name it something you will recognise later, like `dnsense`.
4. Check the permission list. Add **Zone > Zone > Read** if the template left it out.
5. Under **Zone Resources**, choose the zones DNSense may touch. **All zones** is the simplest. A single zone works too, but DNSense will only see that one.

![The token template screen with permissions and zone resources](guide-cloudflare-template.webp)

1. Leave the client IP filter empty unless you know which address DNSense connects from. A filter that does not match makes every call fail.
2. Continue to the summary and read it once.

![The token summary listing the resources and permissions selected](guide-cloudflare-summary.webp)

1. Click **Create Token**.

## Copy it now

Cloudflare shows the token once. Copy it before closing the page. The screen also has a `curl` command that tests the token, which is worth running.

![The completion screen with the token and a curl test command](guide-cloudflare-token.webp)

## Connect it to DNSense

Add a connection, choose **Cloudflare** and pick the **API token** option. Paste the token. The **Account ID** field is optional; leave it empty unless you want to limit DNSense to one account. If you lose the token later, create a new one and replace the credentials on the existing connection. No need to delete it.

## Sitemap

See the full [sitemap](https://dnsense.io/sitemap.md) for all pages.