Connect Cloudflare DNS
Store a scoped Zone.DNS token so the platform can present and clean up _acme-challenge TXT records.
Purpose
Automate DNS-01 without giving the platform your Cloudflare login. The token should edit DNS on one zone, not the whole account billing profile.
Prerequisites
A Cloudflare zone you control and an API token with Zone.DNS Edit on that zone only.
Steps
Create the token in Cloudflare. POST /api/v1/integrations/dns with provider cloudflare and the token. Test the connection. Request a certificate with validation dns-01. Confirm the TXT appears, then that cleanup deletes only that record.
Expected states
connected, healthy, failed. Challenge rows on the order show the exact name and value.
Errors
dns_record_not_found, dns_propagation_timeout, insufficient token scope. We do not claim live E2E in this environment until a disposable zone is configured.
Security
Credentials are encrypted at rest. Do not use a Global API key. Rotate the token from the integration screen.
Related
Academy /academy/dns-01-explained. Insights /insights/dns-01-least-privilege-patterns. Product /dns-automation.