Cloudflare setup guide

Agents work with your code, deployments and incidents.

Ways to connect

Company admins connect apps, on the Integrations page in Everdeck: open Cloudflare, choose one of the ways below, follow its steps and fill in its fields. Everdeck checks what you enter before it saves anything, and asks you to confirm it’s you (your second factor) before you type any secret. How connecting works.

Cloudflare can be connected 2 ways.

Account API token (recommended)

API key.

1. In the Cloudflare dashboard select your account, open Manage account > Account API tokens and select Create Token. (You need the Super Administrator role or permission to provision API tokens.)
2. Name it "Everdeck" and add these permissions. Zone: Zone Read, DNS Edit, Cache Purge, Zone Settings Edit and Analytics Read. Account: Cloudflare Pages Edit and Account Settings Read (for the audit log). Leave out anything the agent should not do, for example DNS Edit for a read-only connection.
3. Limit the zone resources to the zones the agent works on, and add an expiry date if you like.
4. Select Continue to summary, then Create Token, and copy the token (it starts with cfat_ and is shown once) into the form together with your Account ID.
5. Optional, to start work when a Cloudflare Pages deployment starts: once connected, set up the Pages deployment trigger on Everdeck's Intake page and enter the Pages project's name. Everdeck checks that project for new deployments every 5 minutes with this token (its Cloudflare Pages permission covers it).
6. You don't need to add an alert webhook: live alerts from Cloudflare (origin errors, DDoS attacks, health checks, certificates) aren't available yet.

Field	What to enter
Account ID	Text. For example 32-character account ID. Shown on the account's Overview page and in the dashboard URL after dash.cloudflare.com/.
Account API token	A secret: Everdeck saves it encrypted and never shows it again.

Disconnecting deletes the credentials Everdeck saved, but Everdeck can't revoke them: the key, token or password itself keeps working at Cloudflare until you delete or rotate it there.

User API token

API key.

1. Sign in as the Cloudflare user the agent should act as and open My Profile > API Tokens (https://dash.cloudflare.com/profile/api-tokens), then select Create Token and choose a custom token.
2. Add the same permissions as for an account token: Zone Read, DNS Edit, Cache Purge, Zone Settings Edit and Analytics Read for the zones, plus Cloudflare Pages Edit and Account Settings Read for the account. Limit the resources to the account and zones the agent works on.
3. Create the token, copy it (shown once) and paste it into the form with your Account ID. The token stops working if this user loses access to the account.
4. Optional, to start work when a Cloudflare Pages deployment starts: once connected, set up the Pages deployment trigger on Everdeck's Intake page and enter the Pages project's name. Everdeck checks that project for new deployments every 5 minutes with this token.

Field	What to enter
Account ID	Text. For example 32-character account ID.
User API token	A secret: Everdeck saves it encrypted and never shows it again. Where to find it.

Disconnecting deletes the credentials Everdeck saved, but Everdeck can't revoke them: the key, token or password itself keeps working at Cloudflare until you delete or rotate it there.

What agents can do

An agent uses an action only when its charter grants it, on the agent’s Tools tab, where you choose whether each one runs by itself (Auto), asks first or never runs. Each action has a risk tier: tier 3 actions, which customers or the public see, ask first unless you choose otherwise, and tier 4 actions (money, deleting things, access) always need a person. How tools and tiers work.

Actions marked Reads outside content return things people outside your company may have written. Agents treat what they read as information, never as instructions, and their riskier actions later in the same session need approval.

• List zonesTier 0 · ReadReads outside contentcloudflare_list_zones

  List the account's zones (domains) with id, status, plan and Cloudflare name servers. Use the zone id in the DNS, cache, settings and traffic actions.

• List DNS recordsTier 0 · ReadReads outside contentcloudflare_list_dns_records

  List a zone's DNS records with id, type, name, content, whether Cloudflare proxies them, TTL (1 means automatic), priority and comment. Filter by type, exact name, part of the name or content.

• Add a DNS recordTier 3 · ExternalReads outside contentcloudflare_create_dns_record

  Add a DNS record to a zone. It goes live on the internet within seconds. A and AAAA records cannot share a name with a CNAME, and NS records cannot share a name with any other type.

• Change a DNS recordTier 3 · ExternalReads outside contentcloudflare_update_dns_record

  Change an existing DNS record (for example point it at a new address or turn the proxy on or off). Send only the fields that change. Takes effect on the internet within seconds.

• Delete a DNS recordTier 4 · Money or irreversiblecloudflare_delete_dns_record

  Delete a DNS record. Anything that relied on it stops resolving within seconds.

• Purge cached contentTier 2 · ReversibleReads outside contentcloudflare_purge_cache

  Remove cached copies so visitors get fresh content from the origin, for example after a deploy. Send exactly one of files (full URLs), tags (Cache-Tag values), hosts or prefixes (hostname plus path), up to 100 items. Purging everything is not offered.

• Read a zone settingTier 0 · ReadReads outside contentcloudflare_get_zone_setting

  Read one zone setting and whether it can be changed, for example security_level (under_attack means Under Attack mode is on), development_mode (with time_remaining), ssl, always_use_https, min_tls_version or browser_cache_ttl.

• Switch Under Attack or development modeTier 3 · ExternalReads outside contentcloudflare_update_zone_setting

  Turn Under Attack mode on (security_level under_attack: every visitor gets a challenge page first) or off (set the value it had before; medium is Cloudflare's default), or turn development mode on or off (on bypasses the cache for 3 hours). Use only during an attack or while testing changes; it affects every visitor and API client of the zone.

• Check traffic and errorsTier 0 · ReadReads outside contentcloudflare_get_traffic

  Count a zone's visitor requests in a time window, grouped by HTTP status code (to spot 5xx or 4xx spikes) and by hour, with visits and bytes served. Keep the window short (a day or less); the longest allowed window depends on the plan.

• List Pages deploymentsTier 0 · ReadReads outside contentcloudflare_list_pages_deployments

  List a Cloudflare Pages project's deployments, newest first, with id, environment (production or preview), URL, build stage and status, branch, commit and aliases.

• Roll back a Pages siteTier 3 · ExternalReads outside contentcloudflare_rollback_pages_deployment

  Point a Pages project's production site back to an earlier successful production deployment. Visitors get that version immediately.

• Read the audit logTier 0 · ReadReads outside contentcloudflare_list_audit_logs

  See who changed what in the account between two dates: time, action, result, actor (email, IP, token), product, resource and zone. Useful when something broke after a change.

What can start work

These events from Cloudflare can become tasks for your agents through Intake. How Intake works.

A new deployment started in a chosen Cloudflare Pages project.

Connect Cloudflare first. Then, on the Intake page, open Webhooks and sources, find it under Connector triggers and select Start watching. Then, on the Rules tab, select New rule to say which requests become tasks and who gets them.

Testing, problems and disconnecting

Everdeck checks the connection when you save it. On the connection’s page in Integrations, Test checks it again at any time.

If Cloudflare later refuses the connection, for example because a key was deleted or a sign-in expired, the connection shows Needs attention on the Integrations page and the people who manage connections are told. Agents can’t use it until a company admin fixes it with Edit.

To stop agents using Cloudflare, open the connection and select Disconnect. Agents stop using it at once and its saved credentials are deleted. What else happens depends on how it was connected: each way above says.