Only read scopes are requested. TigerGate can never change DNS records, WAF
rules, or zone settings.
Before you start
In TigerGate, open Integrations → Cloud Providers and choose Cloudflare. You’ll fill in two values:| Value | What it is |
|---|---|
| API Token | A read-only token scoped to the account. |
| Account ID (optional) | Restricts the connection to a single Cloudflare account — leave blank to use whatever the token can access. |
1. Create the token
Build a read-only token
Choose Create Custom Token and grant Read access to:
- Account → Account Settings
- Zone → Zone Settings
- Zone → DNS
- Zone → Firewall Services
2. Connect it in TigerGate
Paste the token
In Integrations → Cloud Providers → Cloudflare, paste the token into
API Token. Set Account ID (Cloudflare Dashboard → Overview, right
sidebar) if you have multiple Cloudflare accounts and want to restrict the
scan to one.
Test
Click Test. TigerGate calls Cloudflare’s token-verify endpoint to
confirm the token is valid and active. A wrong, expired, or revoked token
is rejected here with the reason. Verify only checks that the token is
active — a valid token that’s missing a read permission still passes the
test but surfaces the gap when a scan runs.
Troubleshooting
| Scan/Test error | Cause | Fix |
|---|---|---|
Invalid API Token | Token is wrong, expired, or revoked | Generate a new token |
9109 Unauthorized to access requested resource | A required read permission wasn’t granted | Re-create the token with all four permissions in step 2 |
| Zones missing from results | Token scoped to specific zones only | Re-scope the token to All zones, or accept the narrower scan |
| Scan runs but few findings | Account ID points at the wrong account | Clear the field, or verify the ID under Dashboard → Overview |