Connect your app to Cloudflare API

1. 1

   Sign in to your Cloudflare dashboard.

   This is where you will create the special key (API token) your Lovable app needs to connect.

2. 2

   Go to 'Manage Account' and select 'Account API Tokens' for an account token, or 'My Profile' and select 'API Tokens' for a user token.

   You need to access the section where you can create and manage your API tokens.

3. 3

   Click 'Create Token' and choose to create a custom token or use a template.

   This starts the process of generating your unique access key.

4. 4

   Add permissions for each Cloudflare feature your app will use, like 'Zone Read' and 'DNS Edit' for managing DNS.

   This ensures your Lovable app can only do what you intend it to do, and nothing more, for security.

5. 5

   Limit the token to specific zones or accounts under 'Zone Resources' and 'Account Resources'.

   This further restricts what your Lovable app can access, improving security by preventing unintended changes to other parts of your Cloudflare account.

6. 6

   Click 'Continue to summary', then 'Create Token', and copy the token value.

   Cloudflare shows this token only once, and you'll need it for the next step to connect to Lovable.

7. 7

   In Lovable, go to 'Connectors' and select 'Cloudflare API'.

   This is where you will set up the connection using the token you just created.

8. 8

   Click 'Add connection', give it a display name (e.g., 'Cloudflare Prod'), and paste your copied API token into the 'API Token' field.

   This tells Lovable how to identify this connection and provides the secret key to access your Cloudflare account.

9. 9

   Choose who in your workspace can use this connection (e.g., 'Only you', 'Invite specific people', or 'Invite entire workspace').

   This controls who else can use this Cloudflare connection within your Lovable projects.

10. 10

    Click 'Connect'.

    Lovable will verify the token and establish the connection, making it available for your apps.

Use Cloudflare and build a page where I can view and edit the DNS records for my domains.

API token

A special, secret key that acts like a password, allowing your Lovable app to securely talk to Cloudflare's services on your behalf.

DNS

Domain Name System. It's like a phone book for the internet, translating human-readable website names (like example.com) into computer-readable IP addresses.

Zone

In Cloudflare, a 'zone' typically refers to a single domain name (like example.com) that you manage through their service.

GraphQL Analytics API

A specific way to ask Cloudflare for data about your website's traffic and security events, allowing you to get exactly the information you need.

WAF

Web Application Firewall. It's a security shield that protects your website from various online attacks by filtering out bad traffic.

Workers, R2, KV

These are Cloudflare's services for running small pieces of code at the 'edge' (close to your users), storing large files, and storing simple data, respectively.

Resource scope

This defines which specific parts of your Cloudflare account (like certain domains or services) your API token is allowed to access or change.

Rate limits

The maximum number of requests your app can send to Cloudflare's services within a certain time period, to prevent abuse and ensure fair usage.

• Using an API token with too many permissions or too broad a scope, which could allow unintended changes or access to sensitive data.
• Sharing your API token publicly, as it functions like a password and could compromise your Cloudflare account.
• Using a user API token for integrations when an account API token is recommended, which might cause issues if the user leaves the team.
• Forgetting that API requests count towards Cloudflare's rate limits and can incur charges for paid Cloudflare resources.
• Not updating the connection in Lovable if you roll or delete the API token in Cloudflare, which will cause your app to stop working.
• Updating a WAF ruleset with 'PUT' without first reading the existing rules, which can accidentally delete all other rules.