> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare

> Connect Cloudflare to Iru Compliance with a scoped API token to collect zones, DNS records, security settings, WAF rules, and account membership.

### About Cloudflare

Iru reads **zones**, **DNS**, **security and WAF settings**, **firewall rules**, and **account** membership via the Cloudflare API using a **scoped API token** sent as **Bearer** authorization.

### How It Works

```http theme={null}
Authorization: Bearer YOUR_API_TOKEN
```

| Detail             | Value               |
| ------------------ | ------------------- |
| **Category**       | Edge security / DNS |
| **Authentication** | API token (Bearer)  |

Prefer **Account API tokens** (Manage Account → API Tokens) for long-lived automation; **User** tokens follow individual users.

Official references: [Create a token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/), [Restrict tokens](https://developers.cloudflare.com/fundamentals/api/how-to/restrict-tokens/), [API](https://developers.cloudflare.com/api/).

### Prerequisites

* **Admin** or **Super Administrator** (or equivalent) on the Cloudflare account.

### Connect Cloudflare to Iru

<Tabs>
  <Tab title="Cloudflare">
    <Note>
      Complete this tab before you connect the source in Compliance.
    </Note>

    <Steps>
      <Step title="Sign in to Cloudflare">
        Open the [Cloudflare dashboard](https://dash.cloudflare.com) and sign in with an **Admin** or **Super Administrator** account.
      </Step>

      <Step title="Choose account-level or user-level tokens">
        Decide whether Iru should use an **account API token** (**Manage Account** → **API Tokens**) or a **user API token** tied to your profile (**My Profile** → **API Tokens**). Account tokens are common for org-wide evidence; user tokens follow one operator’s access.
      </Step>

      <Step title="Create a token">
        Select **Create Token**. Prefer a **Read** template such as **Read all resources** unless your security team publishes a tighter **custom** policy.
      </Step>

      <Step title="Set read permissions">
        If you use a **custom** token, grant **read** (or equivalent) on **Account**, **Zone**, and **User** objects Iru needs for your frameworks. Avoid write permissions unless policy requires them.
      </Step>

      <Step title="Optional restrictions">
        Set **TTL** (time to live) and **IP allowlists** if your security program expects them. Note any expiry date in your rotation calendar.
      </Step>

      <Step title="Create and copy the token">
        Create the token and copy the secret **once** when Cloudflare displays it. Store it in a vault; you will paste it into Iru as the **Bearer** token.
      </Step>
    </Steps>

    <Note>
      Continue on the [**Iru Compliance**](#iru-compliance) tab.
    </Note>
  </Tab>

  <Tab title="Iru Compliance">
    <Note>
      Finish the [**Cloudflare**](#cloudflare) tab first.
    </Note>

    <Steps>
      <Step title="Open Sources">
        In Iru Compliance, on the left navigation bar, expand **Compliance** and select **Sources**.

        <Frame>
          <img src="https://mintcdn.com/iru/7HsGH7lnQ8GpVmI0/assets/media/images/iru-navigation-compliance-sources.png?fit=max&auto=format&n=7HsGH7lnQ8GpVmI0&q=85&s=595982441fd777b333b3ecfea24adc24" alt="Left navigation: Compliance expanded, Sources selected" width="424" height="1056" data-path="assets/media/images/iru-navigation-compliance-sources.png" />
        </Frame>
      </Step>

      <Step title="Turn on Cloudflare">
        Find **Cloudflare** (use **Category** or **Search by name or description**). On that card, turn on the **toggle**. A browser tab or window may open for the connector wizard.
      </Step>

      <Step title="Paste the API token">
        Paste the token into the **Bearer token** field.
      </Step>

      <Step title="Finish the connection">
        Click **Submit Bearer Token**. When the connection succeeds, the wizard shows **Connection Configured**.
      </Step>

      <Step title="Confirm the source is Active">
        Close the **Iru is requesting access to external services** browser tab, then return to **Compliance** → **Sources** and confirm the **Cloudflare** card is **Active**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

### Troubleshooting

<AccordionGroup>
  <Accordion title="Nothing opens when you turn the source on">
    Check **pop-up blocker** settings for the Iru site and try again.
  </Accordion>

  <Accordion title="401 Unauthorized">
    Verify with `GET https://api.cloudflare.com/client/v4/user/tokens/verify`; check TTL and revocation.
  </Accordion>

  <Accordion title="Missing zones">
    Token scope - recreate with correct account and zone resources.
  </Accordion>

  <Accordion title="Expired token">
    If you set TTL, rotate before expiry and update Iru.
  </Accordion>
</AccordionGroup>

### Considerations

<CardGroup cols={2}>
  <Card title="Iru uses read permissions only: it does not change…" icon="circle-info">
    Iru uses **read** permissions only - it does not change DNS, rules, or zones.
  </Card>
</CardGroup>

### Related Articles

<CardGroup cols={2}>
  <Card title="Sources Management" icon="plug" href="/en/compliance/sources-management">
    Browse and manage every Compliance source.
  </Card>

  <Card title="Getting Started With Compliance" icon="rocket" href="/en/compliance/getting-started-with-compliance">
    Frameworks, actions, and **Artifacts**.
  </Card>

  <Card title="Iru Overview" icon="layer-group" href="/en/iru/platform-overview/iru-overview">
    How Endpoint, Compliance, and Identity fit together.
  </Card>

  <Card title="Artifacts Management" icon="folder-open" href="/en/compliance/artifacts-management">
    Upload, review, and organize evidence from sources and actions.
  </Card>
</CardGroup>