Cloudflare

Cloud API token

Manage Cloudflare DNS, zones, cache, Workers storage and certificates from any Windmill script, flow or app.

Set up in 3 steps

Create an API token

In the Cloudflare dashboard, open My Profile then API Tokens. Create a token, granting only the permissions and zones your scripts need, and copy it.

Add the resource in Windmill

Open Resources, add a resource of type cloudflare, and paste the token and your account ID (from the dashboard URL). Account-level scripts such as KV, R2 and Workers need the account ID; leave email and key empty.

Run your first script

Run List Zones to check the token, then fork any script below. Zone and KV namespace inputs are dropdowns filled from your account.

Scripts

Building blocks, if none of the projects above fit. Fork one, run it, or call it as a step inside your own flow.

Submit a script →

Resource type

The shape of the credential every script on this page expects.

cloudflare

View raw schema →

Field	Type	Required	What it is
token	string	Yes	API token from dash.cloudflare.com/profile/api-tokens. Grant only the permissions your scripts need (e.g. Zone: DNS Edit, Account: Workers KV Storage Edit).
account_id	string	No	Your Cloudflare account ID, shown on the dashboard's Account home and in the URL (dash.cloudflare.com/<account_id>). Required by account-level scripts.
email	string	No	Deprecated (legacy Global API Key auth). Leave empty.
key	string	No	Deprecated (legacy Global API Key). Leave empty.

Questions

What are the email and key fields?

The deprecated Global API Key pair, which authenticates as your whole account with no scoping. Use an API token instead.

Which token permissions do the scripts need?

Only those for what you run: for example Zone DNS Edit for DNS records, Cache Purge for purges, or Workers KV Storage Edit for KV.

A call returns 403 on one zone but works on another

API tokens are scoped per zone and per permission. Edit the token in Cloudflare to include the zone.

How do I read and write R2 objects?

Through R2's S3-compatible API: create an R2 API token and use the S3 integration with endpoint https://<account_id>.r2.cloudflarestorage.com.

Can Cloudflare events trigger a Windmill flow?

Yes, without polling: add a webhook destination under Notifications pointing at a Windmill webhook or HTTP route trigger.

Is my token stored on the hub?

Never. It lives only in your own Windmill workspace, encrypted at rest.

Set up in 3 steps

Create an API token

Add the resource in Windmill

Run your first script

Scripts

Write KV Pairs

Update DNS Record

Send Queue Message

Scrape Elements

Revoke Origin CA Certificate

Read KV Value

Query Workers Observability

Query D1 Database

Purge Cache

List Zones

List Workers

List Worker Deployments

List R2 Buckets

List Origin CA Certificates

List KV Keys

List DNS Records

List D1 Databases

Import DNS Records

Get Screenshot

Get PDF

Get Page as Markdown

Get Rendered HTML

Export DNS Records

Delete DNS Record

Create Zone

Create R2 Bucket

Create Origin CA Certificate

Create KV Namespace

Create IP Access Rule

Create DNS Record

Resource type

cloudflare

Questions