;}%20.st6{fill:url(%23SVGID_00000021089067129159788970000008246765442136188072_);}%20.st7{fill:url(%23SVGID_00000117639240116366130650000015074833605515028638_);}%20.st8{opacity:0.4;fill:url(%23SVGID_00000101781798616409025840000016567063639337360777_);}%20.st9{opacity:0.4;fill:url(%23SVGID_00000052086836598721292040000002033117744178971046_);}%20.st10{opacity:0.4;fill:url(%23SVGID_00000159460939004760751800000002448009281983951536_);}%20.st11{opacity:0.4;fill:url(%23SVGID_00000013177830667419993080000017721442101626521532_);}%20.st12{opacity:0.4;fill:url(%23SVGID_00000152235521444854938490000006526001119318383285_);}%20.st13{opacity:0.4;fill:url(%23SVGID_00000119823135212293698520000012774889010992664993_);}%20%3c/style%3e%3cg%3e%3cpolygon%20class='st2'%20points='134.78,14.22%20114.31,48.21%20101.33,69.75%20158.22,69.75%20177.97,36.95%20191.67,14.22%20'/%3e%3cpolygon%20class='st3'%20points='227.55,69.75%20186.61,69.75%20101.33,69.75%20129.78,119.02%20158.16,119.02%20228.61,119.02%20256,119.02%20'/%3e%3cpolygon%20class='st3'%20points='136.93,132.47%20116.46,167.93%2073.82,241.78%20130.71,241.78%20144.9,217.2%20180.13,156.18%20193.82,132.46%20'/%3e%3cpolygon%20class='st3'%20points='121.7,131.95%20101.23,96.49%2058.59,22.63%2030.15,71.91%2044.34,96.49%2079.57,157.5%2093.26,181.22%20'/%3e%3cpolygon%20class='st2'%20points='64.81,131.95%2025.15,131.21%200,130.74%2028.44,180.01%2066.73,180.72%2093.26,181.21%20'/%3e%3cpolygon%20class='st2'%20points='165.38,181.74%20184.58,216.46%20196.75,238.47%20225.19,189.2%20206.66,155.69%20193.83,132.46%20'/%3e%3c/g%3e%3c/svg%3e)
Windmill HubCloudflare
Cloud API tokenManage zones, DNS, workers, R2 and the rest of the Cloudflare API from any Windmill script, flow or app.
Set up in 3 steps
Create an API token
In the Cloudflare dashboard, open My Profile then API Tokens. Create a token, granting only the permissions and zones your scripts need, and copy it.
Add the resource in Windmill
Open Resources, add a resource of type cloudflare, and paste the token. account_id is there for scripts that need it in a path; leave email and key empty.
Run your first script
Fork any script below and list your zones. There are over a thousand here, so search by the verb you need.
Scripts
Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.
Get Attack Bitrate Summary
Update Cron Triggers
List virtual networks
Update priority of a firewall rule
Update Queue
Delete Hostname Client Certificate
Get IP address
Get a firewall rule
Get Always Use HTTPS setting
Create a list
Execute AI model
Update Prefix Description
Create a new output, connected to a live input
Get Access authentication logs
Get ASN Subnets
Set Account Custom Nameserver Related Zone Metadata
Create Custom Hostname
Update multiple interconnects
Retrieve information about all schemas on a zone
List indicator feed permissions
Get Layer 3 Attacks By Protocol Timeseries
List service tokens
List Cloudflare Tunnel connections
Update rules
Get Top Locations By Device Type
Get the default device settings profile
By Time
Get Deployment Detail
Update all list items
Delete IPFS Universal Path Gateway Content List Entry
Resource type
The shape of the credential every script on this page expects.
cloudflare
View raw schema →| Field | Type | Required | What it is |
|---|---|---|---|
| token | string | Yes | |
| account_id | string | No | |
| string | No | deprecated | |
| key | string | No | deprecated |
Questions
What are the email and key fields?
The legacy Global API Key pair, kept for older scripts and marked deprecated. It authenticates as your whole account with no scoping — use an API token instead.
A call returns 403 on one zone but works on another
API tokens are scoped per zone and per permission. Edit the token in Cloudflare to include the zone, rather than widening it to everything.
Is my token stored on the hub?
Never. It lives only in your own Windmill workspace, encrypted at rest.