Cloudflare

Trustle reads members, permission groups, resource groups, user groups and their members, and audit logs from Cloudflare. Trustle can grant and revoke account-wide permission groups, add and remove user group members, invite people, and remove members.

Prerequisites

• A Cloudflare user who can create account API tokens in Manage Account → Account API Tokens.
• An identity provider connected in Trustle, for example Okta or Microsoft Entra ID. Trustle hides SaaS Applications until one is connected.

Configure Cloudflare

Step 1: Find the account ID

1. Sign in to the Cloudflare dashboard and select the account.
2. Copy the account ID from the browser address bar. It is the 32-character value after dash.cloudflare.com/.

Step 2: Create an account API token

1. Go to Manage Account → Account API Tokens. Do not use My Profile → API Tokens. An account token keeps working after the person who created it leaves.
2. Click Create Token. Under Create Custom Token, click Get started.
3. Enter a name, for example Trustle.
4. Add the permission from Step 3.
5. In TTL, leave the start date empty or set it to today. Trustle rejects a token that is not valid yet, and a token that has expired.
6. Click Continue to summary. Then click Create Token.
7. Copy the token.

Caution

Cloudflare shows the token once. If you lose it, create a new token.

Step 3: Grant permissions

1. In Permissions, select Account → Account Settings, then the level you need:

   Permission	Required	What Trustle does with it
   Account Settings: Read	Yes	Imports members, permission groups, resource groups, user groups and their members, and audit logs.
   Account Settings: Edit	Optional	Grants and revokes permission groups, adds and removes user group members, invites people, and removes members. Without it, the connection is read-only and these requests fail.

Trustle does not need Super Administrator or billing access.

Step 4: Collect the values for Trustle

Trustle field	Where to find it in Cloudflare	Example
Account ID	The browser address bar, after dash.cloudflare.com/	0123456789abcdef0123456789abcdef
API Token	The token from Step 2	<api-token>

Connect in Trustle

1. In Trustle, go to Connections.
2. Under SaaS Applications, find Cloudflare and click Connect.
3. Enter a Connection Name, for example Cloudflare production. Description is optional.
4. Enter the values from Step 4.
5. Click Test Connection.
6. After the test passes, click Save Connection.

Note

Test Connection checks that the token is active and can read the members of this account. It does not check for Edit. Do the steps in Verify after the first sync.

Verify

1. On the Connections page, open the Cloudflare connection.
2. Wait for the first sync to finish.
3. Check that the member count matches Manage Account → Members in Cloudflare.

If something is missing, see Troubleshooting.

Note

• Trustle grants a permission group on the whole account only. Trustle imports permission groups that apply to one zone or app, but it cannot grant or revoke them.
• When a person without a Cloudflare membership gets access, Trustle invites them. The member stays pending, with no access, until the person accepts the email invitation.
• Cloudflare has no suspend action. To stop all access for a member, remove the member.

Caution

Cloudflare does not let anyone remove a member’s last permission group. When time-limited access ends on a member’s last permission group, the revoke fails and the member keeps the access. Remove the member from the Cloudflare account to end the access.

Security notes

Note

• Use a dedicated account API token for Trustle only.
• Grant Account Settings: Read if you use Trustle only for access reviews. Grant Edit only if Trustle must change access.
• Store the token in a secret manager. Never commit it to a repository.
• If you set an expiry date on the token, create a new token before that date. Then paste it into the Trustle connection.

Troubleshooting

Test Connection fails

Trustle does not show the reason yet. Check these values:

• Account ID: copy the 32-character value after dash.cloudflare.com/. Do not copy a zone ID.
• API Token: “Invalid Cloudflare API token” means Cloudflare refused the token. Create it under Manage Account → Account API Tokens. A token from My Profile does not work.
• Permission: “not authorized on this account” means the token does not have Account Settings: Read on this account.
• TTL: “not valid until” means the start date is in the future. “expired” means the end date has passed. Create a new token.

Trustle cannot grant or revoke access

The token has Account Settings: Read only. Edit the token in Cloudflare and change the permission to Account Settings: Edit.

A revoke fails because it is the member’s last grant

Cloudflare requires each member to keep at least one permission group. Remove the member from the Cloudflare account instead.

A grant to a zone-scoped permission group fails

Trustle grants only permission groups that apply to the whole account. Request the account-wide permission group or a user group instead.

A new member has no access after the grant

The member has not accepted the Cloudflare invitation. Ask the person to open the invitation email and accept it.

User groups or last activity are empty

• User groups: if Cloudflare refuses the user group read, the sync continues and the list stays empty.
• Last activity: Trustle reads 90 days of audit logs. Cloudflare logs changes only. A member who only views the dashboard shows no last activity.

None of these fixes work

Email support@trustle.com. Include the error message, the connection name, and the Account ID. Never send a secret, key, or token.