Docs · Connect your tools
Connect Cloudflare
StackWeaver reads, and never changes, your Cloudflare account once a day, through a read-only API token you create yourself. This guide says what is read, which permissions the token needs, how to create one, and how to remove it.
Last reviewed: 6 November 2026 · Describes what is live in production on that date. A result is evidence of what the provider returned at a time, nothing more.
1. What it collects
Once a day StackWeaver calls Cloudflare's API with the token you paste. Each result is kept as an Evidence Object with a SHA-256 fingerprint (platform), including results that fail.
| Check (as shown in the portal) | What it looks at |
|---|---|
| Managed WAF rules deployed | Whether each zone has a managed Web Application Firewall ruleset deployed |
| Minimum TLS 1.2 or higher | The minimum TLS version each zone accepts |
| Always Use HTTPS | Whether each zone redirects HTTP requests to HTTPS |
| DNSSEC active | Whether DNSSEC is active on each zone |
| Admin hostnames behind Cloudflare Access | Whether the admin hostnames you list are protected by a Cloudflare Access application (optional: reported as not tested if you list none) |
| Audit log history | Whether the account's audit log has a usable retention window |
| Two-factor authentication for members | How many account members have two-factor authentication on |
2. What it does not do
- It does not read DNS record contents, page rules, Workers scripts, or any data inside your zones or services beyond the settings above.
- It cannot change any setting: the token it uses carries read permissions only.
- It does not say your account meets any standard. A result is what Cloudflare returned at a certain time.
3. The access it needs
Six read-only API token permission groups (Cloudflare), each used by one or more checks.
| Permission | Used for |
|---|---|
| Zone Read | Listing the zones in the account |
| Zone Settings Read | Minimum TLS version and Always Use HTTPS per zone |
| DNS Read | DNSSEC status per zone |
| Zone WAF Read | Which managed WAF rulesets each zone deploys |
| Access: Apps and Policies Read | Cloudflare Access applications that protect your admin hostnames (account scope) |
| Account Settings Read | Account members' two-factor status and the account audit log |
Who can connect. In StackWeaver, a workspace owner or admin pastes the token. On Cloudflare's side, the token is created by whoever has access to the account's API Tokens page; Cloudflare does not tell StackWeaver who that person is or what role they hold, so give the token only the six permissions above and nothing else.
4. Connect steps
- In the Cloudflare dashboard, go to My Profile, API Tokens, Create Token, and choose Create Custom Token.
- Add the six permissions listed above, each set to Read, scoped to the account (and all zones, or the specific zones you want StackWeaver to check).
- Create the token and copy it — Cloudflare shows it once.
- In StackWeaver, open Evidence, the Cloudflare section, and paste the token together with your Account ID (from the account's Overview page). Optionally list your admin hostnames, separated by commas, so the Access check can run.
- Press Test connection. StackWeaver records the result.
5. Reading the results
| Label | What it means |
|---|---|
| Pass | The provider returned data that meets the threshold at that time |
| Fail | The provider returned data that does not meet the threshold |
| Not enabled | There was nothing to check, or the feature needs a plan StackWeaver could not confirm |
| Could not check | StackWeaver could not read the data, or the check needs a higher plan than the account has |
6. Disconnect and revoke
- In StackWeaver, press Disconnect on the Cloudflare section. StackWeaver deletes the stored token.
- In Cloudflare, go to My Profile, API Tokens, and roll or delete the token yourself — StackWeaver has no way to ask Cloudflare to revoke a token on your behalf.
What remains. Past evidence stays in your workspace as the audit trail. Disconnecting does not delete it.
7. Troubleshooting
| Message | What to do |
|---|---|
| Could not verify this token | Check the token was pasted in full and has not been rolled or deleted in Cloudflare |
| This Cloudflare account is already connected to another StackWeaver workspace | Ask StackWeaver support if this is your account |
| Admin hostnames behind Cloudflare Access: Not tested | List your admin hostnames in the connection settings, separated by commas |
| Audit log history: Could not check | The token may be missing the Account Settings Read permission, or the account's plan may not expose audit log history |
Still stuck? Use the contact page.
Sources and method
Statements about GitHub and Okta link to their own documentation. Statements about StackWeaver link to the page that says them, or are recorded in a claims ledger with the file in StackWeaver's repository that they come from. See oureditorial policy. Spotted an error? Use the contact page.