> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuphos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare

> Connect a Cloudflare account to manage zones and DNS records.

Nuphos authenticates to Cloudflare with a **scoped API token** you create — not
your global API key — so the agent can read your zones and manage DNS records.

## Connect

### Create an API token

In the Cloudflare dashboard, create an **API token** (Account → API Tokens →
Create Token) with permissions for the work you want the agent to do — typically:

* **Zone → DNS → Edit**
* **Zone → Zone → Read**
* **Account → Account Settings → Read**

You'll also need your **Account ID** — a 32-character hex string shown in the
Cloudflare dashboard.

### Connect in Nuphos

In **Connectors → Connect → Cloudflare**, enter:

| Field          | Notes                                                      |
| -------------- | ---------------------------------------------------------- |
| **Account ID** | 32 hex characters, e.g. `023e105f4ecef8ad9ca31a8372d0c353` |
| **API Token**  | The scoped token you created                               |

Nuphos verifies the token against the Cloudflare API before saving, so an invalid
token or account ID is rejected immediately. The token is stored encrypted.

## In the Nuphos app

Your zones and DNS records appear under
[Cloud resources → DNS](/infrastructure/resources) — browse zones and manage A,
CNAME, MX, and other records without leaving Nuphos.

## What the agent can do for you

The agent can list zones and create, update, and delete DNS records across them.
In practice that means asking things like:

* *"Point `app.example.com` at the new load balancer"* — it finds the zone,
  proposes the record change, and applies it once you approve.
* *"Why isn't `api.example.com` resolving?"* — it reads the zone's records and
  correlates them with your [connected cloud accounts](/connectors/overview) to
  trace where traffic should land.

DNS is also part of the agent's bigger picture: when you ask *"what's exposing
`api-prod` to the internet?"*, it traces DNS, ingress, and firewall rules
together.

## Permissions & authorization

Two boundaries govern what happens through this connector:

* **Hard boundary — who can use it.** Only team **Administrators** can bind or
  remove the token, and they can restrict it to specific members with a
  [member allow-list](/security/access-control). Within a session the agent only
  holds credentials you explicitly selected, re-checked on every request.
* **Soft boundary — what the agent may do with it.** Reading zones and records
  is free-form; creating, updating, or deleting records goes through
  [plan approvals](/security/approvals) and
  [Auto-authorization](/security/auto-mode) — so a record change never happens
  without either an explicit instruction or your yes.

The outer limit is the token's own scopes — create it with only the zones and
permissions you want the agent to reach, and Cloudflare enforces the rest.

## Good to know

* Scoped tokens can be limited to **specific zones** in Cloudflare — a good way
  to keep the agent away from zones it has no business touching.
* If you rotate the token in Cloudflare, update the binding in Nuphos; the old
  token stops working immediately.