Cloudflare
Connect Cloudflare to manage zones, DNS, cache, SSL, firewall rules, Workers, and analytics across your accounts.
One Cloudflare API token, prefixed cfut_ and shown once, scoped to the accounts, zones and permissions PopMCP should manage.
- Setup time
- 5 min
- Auth
- API credentials
- API base URL
- https://api.cloudflare.com/client/v4
- Rate limits
- 1,200 requests per five-minute period per user, counted cumulatively across the dashboard, API keys and API tokens.
Before you begin
- Cloudflare account on any plan, including Free
- Super Administrator, or a role that includes API token creation, if you want an account-owned token
- Know which zones PopMCP should touch, because token resources are fixed at creation time
Get your credentials
Open the API Tokens page
Sign in at dash.cloudflare.com, click the user icon at the top right and choose My Profile, then API Tokens. For a token that should outlive your own account, go to Manage Account → API Tokens instead.
API Tokens
Tokens you own, scoped to the accounts, zones and permissions you grant them.
| Token name | Permissions | Last used | Status |
|---|---|---|---|
| Terraform CIcfut_****7d31 | Zone · DNS · Edit | Mar 4, 2026 | Active |
| Old purge scriptcfut_****b209 | Zone · Cache Purge · Purge | Aug 9, 2025 | Expired |
Token values are never shown again after creation. Only names, permissions and last-used dates stay visible.
Pick a template or start a custom token
Click Create Token, then pick a template such as Edit zone DNS, or scroll to Create Custom Token and click Get started.
API token templates
Start from a template, then edit it before the token is created.
| Template | Description | |
|---|---|---|
| Edit zone DNSZone · DNS · Edit | Edit DNS records for a zone | Use template |
| Read all resourcesAccount and Zone · Read | Grant read access to all resources in your account | Use template |
| Edit Cloudflare WorkersAccount · Workers Scripts · Edit | Edit and deploy Workers scripts | Use template |
Use a custom token when PopMCP needs a mix of DNS, cache, firewall and Workers access.
Set the permissions and the resources they apply to
Name the token PopMCP and add one permission row per group, choosing Account, User or Zone and then Edit or Read. Restrict Account Resources and Zone Resources to the accounts and domains PopMCP should manage.
Create Custom Token
Edit grants full create, read, update, delete and list. Read grants list and read only.
| Group | Permission | Level |
|---|---|---|
| Zone | Zone | Read |
| Zone | DNS | Edit |
| Zone | Cache Purge | Purge |
| Account | Workers Scripts | Edit |
Client IP Address Filtering and TTL sit just below the resource pickers and are both optional.
Review the summary and create the token
Check the permission list on the summary screen, then click Create Token. Click Edit token first if a zone or permission is wrong.
Copy the token value
Copy the cfut_ value from the success screen and paste it into PopMCP's API token field.
Create API Token
The token secret is shown once.
The same screen shows a curl command against /user/tokens/verify so you can test the token before pasting it.
Connect in PopMCP
Open your workspace, choose Cloudflare in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| API tokensecret | In Cloudflare: My Profile → API Tokens → Create Token. Pick a template (e.g. "Edit zone DNS") or a custom token scoped to the accounts/zones and permissions you need. Copy the token (shown once) and paste it here. Account-owned tokens (Manage Account → API Tokens) also work. Stored encrypted.Encrypted with AES-256-GCM on save and never shown again. |
PopMCP verifies the credential against Cloudflare immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Verify it worked
PopMCP shows the connector as Connected and lists your zones, and the token returns "This API Token is valid and active" from /user/tokens/verify.
Troubleshooting
10000 Authentication error
Why: The token was pasted with the word Bearer, surrounding quotes or a trailing newline.
Fix: Paste only the raw cfut_ value with no whitespace.
9109 Unauthorized to access requested resource
Why: The permission exists but the zone or account was not included under Zone Resources.
Fix: Edit the token and add the zone, or switch Zone Resources to All zones from an account.
Tools can read but every write fails
Why: The permission row was set to Read rather than Edit.
Fix: Edit the token, change the level to Edit and save.
The token worked, then stopped
Why: A TTL end date was set, or Client IP Address Filtering excludes PopMCP's egress addresses.
Fix: Remove the TTL and the IP filter, or create a replacement token without them.
You closed the success screen before copying
Why: Cloudflare shows the token secret once.
Fix: Open the token from the API Tokens list, choose Roll, and copy the new value.
429 Too Many Requests
Why: Cloudflare caps API traffic at 1,200 requests per five minutes per user, and dashboard activity counts toward it.
Fix: Wait five minutes and batch the work.