Permissions by view
Names are as Cloudflare’s token editor shows them. Give each token only what you use: a view whose permission is missing says which one it needs, instead of failing.
Reading (read token)
Section titled “Reading (read token)”| View | Permission |
|---|---|
| Zone list, Safety | Zone → Zone → Read |
| DNS, DNSSEC, mail servers (MX) | Zone → DNS → Read |
| SSL/TLS settings, HSTS, other zone settings | Zone → Zone Settings → Read |
| Certificates, Origin CA, Custom Origin Trust Store, Authenticated Origin Pulls | Zone → SSL and Certificates → Read |
| Overview, Timeline traffic, Security events, Fix these first | Zone → Analytics → Read |
| Rules and WAF | Zone → Zone WAF, Transform Rules, Cache Rules, Single Redirect → Read |
| IP access rules (zone), security settings | Zone → Firewall Services → Read |
| Bots | Zone → Bot Management → Read |
| API Shield | Zone → API Gateway → Read |
| Client-side security | Zone → Client-side security → Read |
| Load balancing | Zone → Load Balancers → Read, Account → Load Balancing: Monitors and Pools → Read |
| Zone → Email Routing Rules → Read, Zone Settings → Read, Account → Email Routing Addresses → Read | |
| Snippets | Zone → Snippets → Read |
| Logpush (zone) | Zone → Logs → Read |
| Waiting Room | Zone → Waiting Room → Read |
| Zaraz | Zone → Zaraz → Read |
| Health Checks | Zone → Health Checks → Read |
| Workers routes, Timeline deploys | Zone → Workers Routes → Read |
Account
Section titled “Account”| View | Permission |
|---|---|
| Workers, Usage | Account → Account Analytics → Read, Account → Workers Scripts → Read |
| Services a Worker calls (observed) | Account → Account Analytics → Read |
| Workers Logs | Account → Workers Observability → Edit (Cloudflare files the log query as a write; Flarebox only reads) |
| Audit log, members, Timeline changes | Account → Account Settings → Read |
| KV | Account → Workers KV Storage → Read |
| D1 | Account → D1 → Read |
| R2 | Account → Workers R2 Storage → Read |
| Tunnels | Account → Cloudflare Tunnel → Read |
| Pages | Account → Cloudflare Pages → Read |
| Hyperdrive · AI | Account → Hyperdrive / Vectorize / Workers AI → Read |
| Images · Stream | Account → Cloudflare Images → Read, Account → Stream → Read |
| Zero Trust | Account → Access: Apps and Policies → Read, Account → Zero Trust → Read |
| Registrar, expiry alerts | Account → Registrar → Read |
| Lists | Account → Account Filter Lists → Read |
| IP access rules (account) | Account → Account Firewall Access Rules → Read |
| Turnstile, Notifications, Email Security, AI Gateway, Secrets Store, Queues | Account → (that product) → Read |
| Magic Transit / WAN | Account → Magic Transit → Read |
Changing (write token)
Section titled “Changing (write token)”| Change | Permission |
|---|---|
| DNS records, batch, import, DNSSEC | Zone → DNS → Edit |
| SSL/TLS settings, HSTS, other zone settings | Zone → Zone Settings → Edit |
| Origin CA issue and revoke, trust store upload, Authenticated Origin Pulls upload and switches | Zone → SSL and Certificates → Edit |
| Cache purge | Zone → Cache Purge |
| Rules and WAF | Zone → Zone WAF, Transform Rules, Cache Rules, Single Redirect → Edit |
| Load balancers and pools | Zone → Load Balancers → Edit, Account → Load Balancing: Monitors and Pools → Edit |
| Snippets, Logpush, Workers routes, Health Checks, Waiting Room, Zaraz, Bots, API Shield | Zone → (that product) → Edit |
| Live KV, D1, R2 | Account → Workers KV Storage / D1 / Workers R2 Storage → Edit |
| Tunnels | Account → Cloudflare Tunnel → Edit |
| Access on a Tunnel route | Account → Access: Apps and Policies → Edit |
| Pages rollback | Account → Cloudflare Pages → Edit |
| Images, Stream | Account → Cloudflare Images → Edit, Account → Stream → Edit |
| Account products (Lists, IP rules, Turnstile, Notifications, Email Security, AI Gateway, Secrets Store) | Account → (that product) → Edit |
Give the write token the matching read permissions too, so Flarebox can read each change back.
Not needed
Section titled “Not needed”Workers dev, deploys, tail, secrets, rollback and rollouts use your wrangler login, not an API token. Local project features need no Cloudflare access at all.