Cloud Services
      Back to home
      1. Help Center
      2. Integrations
      3. Cloud Services

      Cloudflare - User Guide

      In this article, you will understand step by step how to easily integrate with Cloudflare

      Prerequisites For Cloudflare Integration

      The user creating an API token should have Domain Administrator Read Only permissions. Otherwise the token won’t work even if the right scopes are granted to the token.

      How to Connect Scytale and Cloudflare

      1. In Scytale, go to 'Integrations'.

      2. Search for Cloudflare and select 'Connect'.

      3. Paste the API token you generated in Cloudflare (see instructions below).

         

        How to Generate an API Token in Cloudflare

        1. Log in to Cloudflare.

        2. Click on the user icon (top-right) → My Profile.

        3. In the left-hand menu, go to API Tokens → click Create Token.

        4. Select ‘Use template’ next to ‘Read all resources’.

        5. Edit the Token Name (e.g., ScytaleToken).

          Note: For a seamless experience without the need to reconnect the integration in the future, we highly recommend using the template and granting read access to all resources.

        6. Click Continue to summary → then Create Token.

        7. Copy the token before leaving the page — it will not be shown again.


      Permissions for Cloudflare Integration

      To allow Scytale to collect audit-relevant evidence from Cloudflare, the API token must be granted read-only permissions. There are two options:

      ✅ Recommended: Use the Cloudflare "Read all resources" template

      • Grants read access to all resources across zones and accounts.

      • This ensures full coverage for evidence collection without needing future reconfiguration.

      🔧 Alternative: Use a Custom Token with the following permissions:

      Zone-level:

      • Zone:Fraud Detection:Read

      • Zone:Config Rules:Read

      • Zone:Dynamic Redirect:Read

      • Zone:API Gateway:Read

      • Zone:HTTP DDoS Managed Ruleset:Read

      • Zone:Zone WAF:Read

      • Zone:Zone Settings:Read

      • Zone:Zone:Read

      • Zone:DNS:Read

      • Zone:Load Balancers:Read

      • Zone:Firewall Services:Read

      • Zone:SSL and Certificates:Read

      User-level:

      • User:Memberships:Read

      • User Details:Read

      Account-level:

      • Account:SSL and Certificates:Read

      • Account:API Gateway:Read

      • Account:Access: SSH Auditing:Read

      • Account:Page Shield:Read

      • Account:Magic Firewall:Read

      • Account:L3/4 DDoS Managed Ruleset:Read

      • Account:Account WAF:Read

      • Account:DDoS Protection:Read

      • Account:Account Rulesets:Read

      • Account:Access: Organizations, Identity Providers, and Groups:Read

      • Account:Firewall Access Rules:Read

      • Account:Account Settings:Read

      🛑 Note: The user generating the API token must have Domain Administrator Read Only permissions. Without it, the token will not work, even if scopes are correctly granted.