Cloudflare
Connect Cloudflare from Settings > Integrations to let SubImage sync your accounts, zones, DNS records, members, R2 buckets, Worker scripts and routes, and rulesets without creating and rotating an API token by hand.
What SubImage Does
SubImage uses the Cloudflare OAuth integration as the credential for the
Cloudflare sync module whenever that module has no cloudflare_token
configured. Cloudflare issues a short-lived access token, and SubImage renews it
before each sync, so a connected integration keeps working without you touching
it.
If a sync ever reports that Cloudflare needs reconnecting, reinstall the integration from the same page.
During the consent flow, Cloudflare asks which of your accounts the application may access. SubImage syncs every account the grant reaches.
Consent Scopes
SubImage requests read-only access, and nothing beyond it:
| Scope | Used for |
|---|---|
Account Settings:Read |
Accounts |
Account Membership:Read |
Members and roles |
Zone:Read |
Zones |
Zone DNS:Read |
DNS records |
Workers R2 Storage:Read |
R2 buckets and their custom domains |
Workers Scripts:Read |
Worker scripts |
Workers Routes:Read |
Worker routes |
Account Rulesets:Read |
Account-level rulesets and rules |
Zone WAF:Read |
Zone-level rulesets and rules |
SubImage never requests a write scope for Cloudflare.
SubImage Setup
- Install Cloudflare from Settings > Integrations.
- On the Cloudflare consent screen, select the accounts SubImage may read, then authorize.
- Open the Cloudflare sync module, leave
cloudflare_tokenempty, and enable the module.
cloudflare_token takes precedence over the OAuth integration, so a module that
already has a token keeps using it until you clear the field.
API Token Fallback
Use a Cloudflare API token instead of OAuth when your account administrator has turned off Public OAuth App access under Manage Account > Members > Settings, or when you want the credential held in your own AWS Secrets Manager. For token setup, see the Cloudflare module setup guide.
Revoking Access
Revoke SubImage's access from the Cloudflare dashboard under Manage OAuth authorizations on your profile page, and remove the installation from Settings > Integrations.
Troubleshooting
If a sync reports that Cloudflare rejected the authorization, reinstall Cloudflare from Settings > Integrations so Cloudflare issues a fresh grant. This is what happens when the authorizing user revokes the application or loses access to the account.
If a sync reports a missing permission, reinstall as well: the grant is fixed at the scopes you consented to, so a scope added after your consent only takes effect on a new authorization.
If the install button reports that the integration is not configured, this SubImage deployment has no Cloudflare OAuth client credentials. Use an API token in the Cloudflare module instead, or contact your SubImage administrator.