;}%20.st6{fill:url(%23SVGID_00000021089067129159788970000008246765442136188072_);}%20.st7{fill:url(%23SVGID_00000117639240116366130650000015074833605515028638_);}%20.st8{opacity:0.4;fill:url(%23SVGID_00000101781798616409025840000016567063639337360777_);}%20.st9{opacity:0.4;fill:url(%23SVGID_00000052086836598721292040000002033117744178971046_);}%20.st10{opacity:0.4;fill:url(%23SVGID_00000159460939004760751800000002448009281983951536_);}%20.st11{opacity:0.4;fill:url(%23SVGID_00000013177830667419993080000017721442101626521532_);}%20.st12{opacity:0.4;fill:url(%23SVGID_00000152235521444854938490000006526001119318383285_);}%20.st13{opacity:0.4;fill:url(%23SVGID_00000119823135212293698520000012774889010992664993_);}%20%3c/style%3e%3cg%3e%3cpolygon%20class='st2'%20points='134.78,14.22%20114.31,48.21%20101.33,69.75%20158.22,69.75%20177.97,36.95%20191.67,14.22%20'/%3e%3cpolygon%20class='st3'%20points='227.55,69.75%20186.61,69.75%20101.33,69.75%20129.78,119.02%20158.16,119.02%20228.61,119.02%20256,119.02%20'/%3e%3cpolygon%20class='st3'%20points='136.93,132.47%20116.46,167.93%2073.82,241.78%20130.71,241.78%20144.9,217.2%20180.13,156.18%20193.82,132.46%20'/%3e%3cpolygon%20class='st3'%20points='121.7,131.95%20101.23,96.49%2058.59,22.63%2030.15,71.91%2044.34,96.49%2079.57,157.5%2093.26,181.22%20'/%3e%3cpolygon%20class='st2'%20points='64.81,131.95%2025.15,131.21%200,130.74%2028.44,180.01%2066.73,180.72%2093.26,181.21%20'/%3e%3cpolygon%20class='st2'%20points='165.38,181.74%20184.58,216.46%20196.75,238.47%20225.19,189.2%20206.66,155.69%20193.83,132.46%20'/%3e%3c/g%3e%3c/svg%3e)
Windmill HubCloudflare
Cloud API tokenManage DNS records, zones, cache, KV, D1, Queues, R2 buckets and certificates, render pages with Browser Rendering, and inspect Workers and their logs from any Windmill script, flow or app.
Set up in 3 steps
Create an API token
In the Cloudflare dashboard, open My Profile then API Tokens. Create a token, granting only the permissions and zones your scripts need, and copy it.
Add the resource in Windmill
Open Resources, add a resource of type cloudflare, paste the token and your account ID (from the dashboard URL, dash.cloudflare.com/<account_id>). Account-level scripts (KV, R2, Workers, Browser Rendering, IP rules) need it. Leave email and key empty.
Run your first script
Run List Zones to check the token, then fork any of the scripts below. Zone and KV namespace inputs are dropdowns filled from your account.
Scripts
Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.
Write KV Pairs
Update DNS Record
Send Queue Message
Scrape Elements
Revoke Origin CA Certificate
Read KV Value
Query Workers Observability
Query D1 Database
Purge Cache
List Zones
List Workers
List Worker Deployments
List R2 Buckets
List Origin CA Certificates
List KV Keys
List DNS Records
List D1 Databases
Import DNS Records
Get Screenshot
Get PDF
Get Page as Markdown
Get Rendered HTML
Export DNS Records
Delete DNS Record
Create Zone
Create R2 Bucket
Create Origin CA Certificate
Create KV Namespace
Create IP Access Rule
Create DNS Record
Resource type
The shape of the credential every script on this page expects.
cloudflare
View raw schema →| Field | Type | Required | What it is |
|---|---|---|---|
| token | string | Yes | API token from dash.cloudflare.com/profile/api-tokens. Grant only the permissions your scripts need (e.g. Zone: DNS Edit, Account: Workers KV Storage Edit). |
| account_id | string | No | Your Cloudflare account ID, shown on the dashboard's Account home and in the URL (dash.cloudflare.com/<account_id>). Required by account-level scripts. |
| string | No | Deprecated (legacy Global API Key auth). Leave empty. | |
| key | string | No | Deprecated (legacy Global API Key). Leave empty. |
Questions
What are the email and key fields?
The legacy Global API Key pair, kept for older scripts and marked deprecated. It authenticates as your whole account with no scoping — use an API token instead.
A call returns 403 on one zone but works on another
API tokens are scoped per zone and per permission. Edit the token in Cloudflare to include the zone, rather than widening it to everything.
How do I read and write R2 objects?
Through R2's S3-compatible API: create an R2 API token in the dashboard, then use the S3 integration with endpoint https://<account_id>.r2.cloudflarestorage.com. The Cloudflare scripts here list and create buckets.
Can Cloudflare events trigger a Windmill flow?
Yes, without polling. Add a webhook destination under Notifications (or Logpush) pointing at a Windmill webhook or HTTP route trigger, and pick the alerts to send.
Which token permissions do the scripts need?
Only what you run: Zone DNS Edit for DNS records, Zone Settings Edit for SSL/security/development mode, Cache Purge, Workers KV Storage Edit, Workers R2 Storage Edit, Browser Run (Browser Rendering) Write, Workers Observability Read, Workers Scripts Read, D1 Edit, Queues Edit, Account Firewall Access Rules Edit, and SSL and Certificates Edit for Origin CA certificates.
Is my token stored on the hub?
Never. It lives only in your own Windmill workspace, encrypted at rest.