1. Determine if you want a user token or anAccount owned token. Use Account owned tokens if you prefer service tokens that are not associated with users and yourdesired API endpoints are compatible.

2. From theCloudflare dashboard ↗, go toMy Profile >API Tokens for user tokens. For Account Tokens, go toManage Account >API Tokens.

3. SelectCreate Token.

4. Select a template from the availableAPI token templates or create a custom token. The following example uses theEdit zone DNS template.

5. Add or edit the token name to describe why or how the token is used. Templates are prefilled with a token name and permissions.

   

6. Modify the token's permissions. After selecting a permissions group (Account,User, orZone), choose what level of access to grant the token. Most groups offerEdit orRead options.Edit is full CRUDL (create, read, update, delete, list) access, whileRead is the read permission and list where appropriate. Refer to theavailable token permissions for more information.

7. Select which resources the token is authorized to access. For example, grantingZone DNS Read access to a zoneexample.com will allow the token to read DNS records only for that specific zone. Any other zone will return an error for DNS record reads operations. Any other operation on that zone will also return an error.

8. (Optional) Restrict how a token is used in theClient IP Address Filtering andTTL (time to live) fields.

9. SelectContinue to summary.

10. Review the token summary. SelectEdit token to make adjustments. You can also edit a token after creation.

11. SelectCreate Token to generate the token's secret.
12. Copy the secret to a secure place.

Warning

The token secret isonly shown once. Do not store the secret in plaintext where others can access it. Anyone with this token can perform the authorized actions against the resources that the token has access to.

The token secret page also includes an example command to test the token. Use the/user/tokens/verify endpoint to fetch the current status of the given token.

curl"https://api.cloudflare.com/client/v4/user/tokens/verify"\
--header"Authorization: Bearer <API_TOKEN>"

The result:

{
"result":{
"id":"100bf38cc8393103870917dd535e0628",
"status":"active"
},
"success":true,
"errors":[],
"messages":[
{
"code":10000,
"message":"This API Token is valid and active",
"type":null
}
]
}

With this you have successfully created an API token and can start working with the Cloudflare API. After creating your first API token, you can create additional API tokensvia the API.