KeyKeeperCloudflare · User API Token
How an agent gets a Cloudflare · User API Token key through KeyKeeper, what to choose on dash.cloudflare.com, and how KeyKeeper verifies it.
| Template id | cloudflare (also cf, cloudflare-token, wrangler) |
|---|---|
| Field | cloudflare-api-token → CLOUDFLARE_API_TOKEN · secret |
| Key looks like | shown once when created |
| Created at | dash.cloudflare.com |
| Verified by KeyKeeper | not verified |
| Template checked | 2026-09-15 |
What the agent does
keykeeper providers show cloudflare
keykeeper save --provider cloudflare --from-clipboard --create --purpose "what this task does"
keykeeper run -c cloudflare -- <your command>--provider cloudflare fills in the credential id and the field. The environment
variable is the one Cloudflare's own tools read, so nothing has to be mapped.
What only you can do
What to choose
Create Custom Token: permissions at Read where possible, Zone Resources = Specific zone (never All zones), and a TTL. Use an account-owned token only if the task needs it (it verifies at a different endpoint).
The agent is told the same thing. It opens the page for you and says what to pick; it never logs in, passes 2FA or pays on your behalf.
What KeyKeeper checks
- Before writing: the value must look like a Cloudflare · User API Token key (shown once when created). A wrong paste is refused before anything is stored, and the agent is told why — without the value.
- After saving: Cloudflare · User API Token offers no read-only endpoint KeyKeeper can use, so the first real call is the test.
Rotation and expiry
No expiry unless a TTL was set at creation; Roll replaces the secret and keeps the permissions. Rotate or revoke at dash.cloudflare.com.