Skip to main content
Nuphos authenticates to Cloudflare with a scoped API token you create — not your global API key — so the agent can read your zones and manage DNS records.

​
Connect

​
Create an API token

In the Cloudflare dashboard, create an API token (Account → API Tokens → Create Token) with permissions for the work you want the agent to do — typically:
  • Zone → DNS → Edit
  • Zone → Zone → Read
  • Account → Account Settings → Read
You’ll also need your Account ID — a 32-character hex string shown in the Cloudflare dashboard.

​
Connect in Nuphos

In Connectors → Connect → Cloudflare, enter: Nuphos verifies the token against the Cloudflare API before saving, so an invalid token or account ID is rejected immediately. The token is stored encrypted.

​
In the Nuphos app

Your zones and DNS records appear under Cloud resources → DNS — browse zones and manage A, CNAME, MX, and other records without leaving Nuphos.

​
What the agent can do for you

The agent can list zones and create, update, and delete DNS records across them. In practice that means asking things like:
  • “Point app.example.com at the new load balancer” — it finds the zone, proposes the record change, and applies it once you approve.
  • “Why isn’t api.example.com resolving?” — it reads the zone’s records and correlates them with your connected cloud accounts to trace where traffic should land.
DNS is also part of the agent’s bigger picture: when you ask “what’s exposing api-prod to the internet?”, it traces DNS, ingress, and firewall rules together.

​
Permissions & authorization

Two boundaries govern what happens through this connector:
  • Hard boundary — who can use it. Only team Administrators can bind or remove the token, and they can restrict it to specific members with a member allow-list. Within a session the agent only holds credentials you explicitly selected, re-checked on every request.
  • Soft boundary — what the agent may do with it. Reading zones and records is free-form; creating, updating, or deleting records goes through plan approvals and Auto-authorization — so a record change never happens without either an explicit instruction or your yes.
The outer limit is the token’s own scopes — create it with only the zones and permissions you want the agent to reach, and Cloudflare enforces the rest.

​
Good to know

  • Scoped tokens can be limited to specific zones in Cloudflare — a good way to keep the agent away from zones it has no business touching.
  • If you rotate the token in Cloudflare, update the binding in Nuphos; the old token stops working immediately.