Skip to main content
Nuphos connects to Cloudflare by OAuth — you choose what it may manage, then authorize in your browser. There is no API token to create, scope, or paste.

​
Connect

In Connectors → Connect → Cloudflare, set an access level for each resource before authorizing: Anything left Off is never requested, so Cloudflare itself refuses it — the boundary does not depend on Nuphos asking nicely. Account discovery rides a read-only baseline that is always requested. Clicking Connect with Cloudflare opens Cloudflare’s authorization page in your browser. Access tokens are stored encrypted and refreshed automatically; revoke them anytime from your Cloudflare account.
Bindings created before OAuth used a scoped API token and keep working unchanged. New connections use OAuth.

​
R2 object access

Browsing buckets uses the OAuth grant, but listing, uploading, downloading, and deleting objects speaks the S3 API, which needs its own credential. Add an R2 Access Key ID / Secret Access Key pair to the binding to enable the object browser. Bucket-level operations work without it.

​
In the Nuphos app

A bound account gets its own pages:
  • Zones and DNS — browse zones, manage A, CNAME, MX and other records.
  • Workers — scripts, routes, cron triggers, and their bindings.
  • Pages — projects, deployments, and deployment logs.
  • R2 — buckets, and the object browser when S3 credentials are configured.
  • D1 — databases and their schema.
  • KV — namespaces, keys, and values.
  • IAM — what this binding can actually reach, given the scopes you granted.

​
What the agent can do for you

The agent can read and change anything within the scopes you granted:
  • “Point app.example.com at the new load balancer” — it finds the zone, proposes the record change, and applies it once you approve.
  • “Why isn’t api.example.com resolving?” — it reads the zone’s records and correlates them with your connected cloud accounts to trace where traffic should land.
  • “Which Worker is throwing after this morning’s deploy?” — it reads the script, its routes, and the deployment history.
DNS is also part of the agent’s bigger picture: when you ask “what’s exposing api-prod to the internet?”, it traces DNS, ingress, and firewall rules together.

​
Permissions & authorization

Three boundaries govern what happens through this connector:
  • The OAuth grant. The outer limit. A resource left Off, or granted Read, cannot be written no matter what anyone asks for — Cloudflare enforces it.
  • Hard boundary — who can use it. Only team Administrators can bind or remove the account, and they can restrict it to specific members with a member allow-list. Within a session the agent only holds credentials you explicitly selected, re-checked on every request.
  • Soft boundary — what the agent may do with it. Reads run freely; anything that changes state goes through plan approvals and Auto-authorization — so a record change never happens without either an explicit instruction or your yes.

​
Good to know

  • Grant Read rather than Write for anything you only want to look at. It is the one boundary the agent cannot argue its way past.
  • Revoking the authorization in Cloudflare invalidates the binding immediately; reconnect in Nuphos to restore it.