How DSALTA integrates with Cloudflare — data collected, setup guide, and automated compliance checks.
Overview
How to connect
Automated checks
Useful links
DSALTA connects to Cloudflare using read-only API access to collect compliance evidence automatically. Data feeds into your Data Library modules. Compliance checks re-run once a day at 02:00 America/New_York.
Read-only access. DSALTA never modifies, creates, or deletes resources in your Cloudflare environment.
DSALTA reads the Cloudflare user roster — names, emails, roles, active status and each member’s two-factor status (Yes, No, or Unknown), which appears on your Access page; and your Cloudflare resources — zones, KV namespaces, R2 buckets and Worker scripts — which appear on your Inventory page.It calls these Cloudflare endpoints:
/user/tokens/verify
/accounts
/accounts/{accountId}/members
/accounts/{accountId}/storage/kv/namespaces
/accounts/{accountId}/r2/buckets
/accounts/{accountId}/workers/scripts
/zones
/zones/{zoneId}/settings/{setting}
Permissions the checks require:Account:Read, SSL and Certificates:Read and Zone:Read. These three cover the compliance checks. To populate the Inventory page as well, build the token from Cloudflare’s Read all resources template, which adds the separate read permissions that Workers KV namespaces, R2 buckets and Worker scripts each require.Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Cloudflare environment.
There is no Reconnect button. Open Integrations → Connected, click Manage on the Cloudflare card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Cloudflare. This usually happens when API tokens expire.
Data is not syncing
Verify the connected account still holds the permissions listed under Before you begin. Then open Integrations in the DSALTA sidebar, stay on the Connected tab, and click Sync from integrations at the top right. That button refreshes every connected integration at once — there is no per-integration sync control.
Cloudflare API token (Read all resources template).Before you begin
Cloudflare account with permission to create API tokens
Open Integrations in the DSALTA sidebar, find Cloudflare, and click Connect to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.
2
Verify permissions
Confirm you can create API tokens: in the Cloudflare dashboard, open the account menu at the top right, choose My Profile, then API Tokens.
3
Create API Token
On the API Tokens page click Create Token, choose the Read all resources template, review the Account Resources and Zone Resources it will cover, then click Continue to summary and Create Token. Copy the token value straight away — Cloudflare shows it only once.
Copy the token immediately — Cloudflare states “The token secret is only shown once.” Leave TTL blank unless you have a rotation reminder: when the token expires the daily Cloudflare checks start failing, and because there is no Reconnect button the only repair is Disconnect and connect again, which permanently deletes the Cloudflare access records, inventory and test results already collected.
Use an API token, not your Global API Key. DSALTA sends the value as Authorization: Bearer …, which is the API-token scheme; the Global API Key uses the legacy X-Auth-Key/X-Auth-Email headers and will simply be rejected.
A token narrowed to just Account:Read, Zone:Read and SSL and Certificates:Read satisfies the three compliance checks but not the Inventory page — Workers KV namespaces, R2 buckets and Worker scripts each need their own read permission. If the token cannot read them, DSALTA records nothing for them and shows no error, so use the Read all resources template unless you deliberately want a checks-only connection.
Set Account Resources and Zone Resources to include every account and zone you want covered. DSALTA enumerates whatever the token can see — /accounts for the member roster and inventory, /zones for the HTTPS check — so anything excluded here is simply absent from the Access and Inventory pages rather than reported as an error.
4
Connect Cloudflare
Paste API token and click Connect.
DSALTA validates the credential when you click Connect. On success the integration moves to the Connected tab, and Manage → Status reads Connected and working properly. Checks begin reporting after the first sync.
If the connection is rejected. Invalid API token or insufficient permissions.The on-screen message is generic — see Connection error messages.
Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Click any check for step-by-step remediation guidance.
.png?fit=max&auto=format&n=tsMQJyneJ1xquFUo&q=85&s=4d401cc03b547d99b6f75a6bd170c334)