Security & Backup

Cloudflare

Browse your Cloudflare Accounts, members, roles, and zones from Dex - read-only, with per-tenant isolation for MSPs.

Dex connects to the Cloudflare API so admins can browse Account details, members, and roles in plain language. One Cloudflare API Token can span many Accounts, and each Dex tenant maps to a single Cloudflare Account id, so managed customers stay isolated. Reads are the shipped surface: list Accounts and zones from the MSP master, and read one Account plus its members and roles on a scoped child, where the Account path segment is forced to that tenant. Available as an MSP global app - one shared API Token, per-tenant scoping by account_id.

Start free →See Dex Live

What Dex does with Cloudflare

Dex handles both admin workflows and employee self-service — all policy-guardrailed and audit-logged.

For admins (Dex Pro)

List every Cloudflare Account the API Token can reach (MSP master connection only)
Read one Cloudflare Account by id, path-forced to this tenant on a scoped child
List the members of this tenant's Cloudflare Account
List the roles defined on this tenant's Cloudflare Account
List Cloudflare zones from the MSP master connection
Deploy as an MSP global app - one shared API Token, each customer confined to its Account via account_id (32 hex chars)

Just ask Dex

Your team types a request in plain language. Dex investigates, plans, and executes — with the right guardrails.

Admin prompts

>List every Cloudflare Account this token can see
>Show me the details for our Cloudflare Account
>Who are the members on the Contoso Cloudflare Account?
>What roles are defined on this Cloudflare Account?
>List the Cloudflare zones on the master connection

Policy actions

Every action Dex can take on Cloudflare is declared, scoped, and guardrailed. Admins control which apply, who approves them, and whether they're limited to self-service.

Action	What it does	Guardrails
`cloudflare_list_accounts`	List every Cloudflare Account (master connection only)	—
`cloudflare_get_account`	Read one Cloudflare Account by id (path-forced on a scoped child)	—
`cloudflare_list_account_members`	List members for this Cloudflare Account (path-forced)	—
`cloudflare_list_account_roles`	List roles for this Cloudflare Account (path-forced)	—
`cloudflare_list_zones`	List Cloudflare zones (master connection only; refused on a scoped child)	—

How to configure Cloudflare

Onboarding takes minutes. Dex validates your credentials before saving them.

Setup steps

1
In the Cloudflare dashboard, go to My Profile > API Tokens (or Account > API Tokens) and create an API Token.
2
Prefer a token that can list Accounts and read Zones for the Accounts you manage.
3
For the MSP master connection, leave account_id blank so Dex can list Accounts and look up each tenant's id.
4
For a tenant connection, find the Account id (32 lowercase hex chars) in the dashboard sidebar or via GET /accounts on the master, and save it as account_id.
5
In Dex, enable the Cloudflare integration and paste the API Token; Dex validates it with a live read before saving.

Credentials required

api_token: Cloudflare API Token that can list Accounts and read Zones for the Accounts you manage (secret; never surfaced)
account_id: This tenant's Cloudflare Account id (32 lowercase hex chars). Leave blank on the MSP master; set it on the tenant's own connection for per-tenant scoping

Requirements

•A Cloudflare account with an API Token that can list Accounts and read Zones
•Read-only for now - Dex browses Accounts, members, roles, and zones but does not modify them
•On a scoped child connection, GET /accounts (roster) and all /zones routes are refused (fail-closed); read them from the MSP master
•For MSPs, deploy as a global app with one shared API Token and per-tenant scoping by account_id