Cloudflare
Connect Cloudflare from Settings > Integrations to let SubImage sync your accounts, zones, DNS records, members, R2 buckets, Worker scripts and routes, and rulesets without creating and rotating an API token by hand.
What SubImage Does
SubImage uses the Cloudflare OAuth integration as the credential for the
Cloudflare sync module whenever that module has no cloudflare_token
configured. Cloudflare issues a short-lived access token, which SubImage renews
before each sync when Cloudflare grants it the means to.
Cloudflare does not let a third-party application ask for offline access, so it may decline to issue a renewal credential. If that happens, a sync will eventually report that Cloudflare needs reconnecting, and you reinstall the integration from the same page. Use an API token instead if you would rather not reconnect periodically.
During the consent flow, Cloudflare asks which of your accounts the application may access. SubImage syncs every account the grant reaches.
Consent Scopes
SubImage requests read-only access, and nothing beyond it:
| Scope | Used for |
|---|---|
Account Settings:Read |
Accounts |
Account Membership:Read |
Members and roles |
Zone:Read |
Zones |
Zone DNS:Read |
DNS records |
Workers R2 Storage:Read |
R2 buckets and their custom domains |
Workers Scripts:Read |
Worker scripts |
Workers Routes:Read |
Worker routes |
Account Rulesets:Read |
Account-level rulesets and rules |
Zone WAF:Read |
Zone-level rulesets and rules |
SubImage never requests a write scope for Cloudflare.
SubImage Setup
- Install Cloudflare from Settings > Integrations.
- On the Cloudflare consent screen, select the accounts SubImage may read, then authorize.
- Open the Cloudflare sync module, leave
cloudflare_tokenempty, and enable the module.
cloudflare_token takes precedence over the OAuth integration, so a module that
already has a token keeps using it until you clear the field.
API Token Fallback
Use a Cloudflare API token instead of OAuth when your account administrator has turned off Public OAuth App access under Manage Account > Members > Settings, or when you want the credential held in your own AWS Secrets Manager. For token setup, see the Cloudflare module setup guide.
Revoking Access
Revoke SubImage's access from the Cloudflare dashboard under Manage OAuth authorizations on your profile page, and remove the installation from Settings > Integrations.
Troubleshooting
If a sync reports that Cloudflare rejected the authorization, reinstall Cloudflare from Settings > Integrations so Cloudflare issues a fresh grant. This is what happens when the authorizing user revokes the application or loses access to the account.
If a sync reports a missing permission, reinstall as well: the grant is fixed at the scopes you consented to, so a scope added after your consent only takes effect on a new authorization.
If the install button reports that the integration is not configured, this SubImage deployment has no Cloudflare OAuth client credentials. Use an API token in the Cloudflare module instead, or contact your SubImage administrator.