Customer setup guide

Connect one Cloudflare account.

Create a new account-owned token with only four required Read permissions, scope it to one account and all of its full, partial, and secondary public zones, then let the Sythe Labs platform inventory configuration without changing Cloudflare.

Open signed-in Integrations Read Cloudflare token documentation

Connection availability

The signed-in Sythe Labs platform Integrations page is the source of truth for connection access. This public page documents customer setup and does not announce availability.

Overview

A narrow read path for public-zone posture.

The Sythe Labs platform reads one Cloudflare account and the public zones visible to the customer-owned token. It uses seven bounded reads to maintain inventory, prepare an account-member review package, and evaluate four supporting configuration checks. It does not issue requests that create, edit, pause, delete, rotate, or revoke anything in Cloudflare.

Read pathGET requests only

Validate the token

Confirm that the account-owned token is active and usable.

Token verification

Read the account

Confirm account access and observe account-level 2FA enforcement.

Account Settings Read

List account members

Collect member identity, status, assigned roles, and privilege provenance for Periodic Access Review preparation.

Account Settings Read

List public zones

Collect full, partial, and secondary zones in the selected account.

Zone Read

Read DNSSEC

Observe DNSSEC for each applicable full or secondary zone.

DNS Read

Read HTTPS enforcement

Observe the Always Use HTTPS setting for every public zone.

Zone Settings Read

Read minimum TLS

Observe the minimum TLS version for every public zone.

Zone Settings Read

Your scope confirmation defines completeness

Cloudflare hides resources outside a token's scope. The Sythe Labs platform cannot discover that an omitted zone exists, so your confirmation that the token covers all full, partial, and secondary public zones in the selected account is the declared inventory boundary.

Before you start

Choose the account and verify customer ownership.

The customer creates and controls the credential. Do not send a Cloudflare token to Sythe Labs staff, paste it into a support request, or ask staff to enter the Cloudflare dashboard.

01
A Cloudflare Super Administrator for the account you intend to connect.
02
One Cloudflare account selected for this connection.
03
A list of all full, partial, and secondary public zones in the selected account, used to verify complete token scope.
04
Organization administrator access to the signed-in Sythe Labs platform Integrations page.

Cloudflare role requirement

Cloudflare requires a Super Administrator to create an account-owned API token. The role is needed for token creation. Create the resulting token with only the four Read permissions in this guide and no additional permissions.

Create the token

Grant one account permission and three zone permissions.

Start from the intended account so the credential is account-owned. Use Cloudflare's standard token form and create the two policies shown below.

Use an account-owned API token

Do not enter a Cloudflare Global API Key or a user-owned token. The connection accepts the account-owned token described in this guide.

Validation proves required reads, not complete grants

Cloudflare's token verification response does not expose the token's complete grant list. The Sythe Labs platform therefore cannot detect extra Edit or other permissions. Review the Cloudflare token summary and submit a token with only the four Read rows in this guide. The connector itself performs only the seven documented read operations.

Cloudflare Entire Account policy with Account Settings Read selected — Policy 1: Entire Account - Account Settings Read.

Cloudflare All Domains policy with DNS Read, Zone Read, and Zone Settings Read selected — Policy 2: All Domains - DNS Read, Zone Read, and Zone Settings Read.

01
Open the intended account in the Cloudflare dashboard.
02
Go to Manage Account, then Account API Tokens, and choose Create Token.
03
Give the account-owned token a name that identifies its use by the Sythe Labs platform.
04
Add the two policies shown below.
05
Choose Continue to summary and confirm that the token has only the four shown Read permissions. Add an expiry only when your organization has a replacement process.
06
Choose Create Token and copy the generated secret directly into your password manager. Cloudflare shows it only once.

Account > Account Settings > Read

Read the account, its two-factor authentication enforcement setting, and account-member privileges.

Zone > Zone > Read

Discover all full, partial, and secondary public zones in the selected account.

Zone > DNS > Read

Read DNSSEC status for full and secondary zones.

Zone > Zone Settings > Read

Read Always Use HTTPS and minimum TLS version for each public zone.

Open Cloudflare dashboard

Find the Account ID

Copy the identifier from the same account.

Open the Cloudflare dashboard and select Search, or press CMD/CTRL + K from any page. Enter Copy account ID and select the result to copy it. The Sythe Labs platform expects the 32-character Account ID, not a zone ID or account name.

Read Cloudflare Account ID instructions

Connect in the Sythe Labs platform

Enter the customer-owned values and confirm scope.

01
Open the signed-in Sythe Labs platform Integrations page and open the Cloudflare connection form when it is shown.
02
Enter the 32-character Cloudflare Account ID and the account-owned API token.
03
Select Connect. This confirms the two-policy scope shown in this guide.
04
The Sythe Labs platform verifies the token, account, terminal account-member listing, terminal public-zone listing within the declared scope, DNSSEC where applicable, and both required zone settings before storing the token. This proves the required reads work, not that the token has no additional grants.

Connection stays unchanged after failed validation

A denied, incomplete, canceled, throttled, or unsupported result does not store a new token, remove inventory, or mark the sync successful. Correct the reported reason and submit again.

Access and data

Inventory the public edge without reading DNS records.

Account

The connected Cloudflare account and its account-level 2FA enforcement state.

Public zones

All full, partial, and secondary public zones after the customer confirms complete token scope, including lifecycle and paused observations when Cloudflare supplies them.

Configuration

DNSSEC where applicable, Always Use HTTPS, and minimum TLS version for the public-zone population.

Account members

Member identity, status, assigned roles, and privilege provenance are retained in a bounded review package. Members are not cloud-asset inventory rows.

Excluded

Internal DNS, DNS record content, Workers, Pages, R2, WAF, certificates, logs, analytics, and products outside this guide.

Supporting configuration checks

Account two-factor authentication enforcement
DNSSEC for applicable active full and secondary zones
Always Use HTTPS for every active public zone
Minimum TLS version for every active public zone

DNSSEC is not applicable to a partial-only population. Optional account 2FA, zone account, status, type, paused state, and DNSSEC status remain unknown when Cloudflare omits them rather than being presented as passing facts. A missing HTTPS or TLS setting fails safely as an unsupported provider result. Only a complete successful sync refreshes inventory and supporting evidence.

Periodic Access Review

Review the exact current member package.

After a complete successful sync, the Sythe Labs platform prepares a bounded observed package containing the current Cloudflare account-member identities, statuses, assigned roles, and privilege provenance. The package is pinned to the connection generation, collection time, package version, and member-set hash.

The observed package is review input only. A human reviewer must inspect and attest the exact current package through the existing evidence-review workflow before it can support IAC-17 Periodic Review of Account Privileges. An intervening sync, token replacement, disconnect, stale connection, or changed member set invalidates the selected package and requires a new review.

No automatic access-review claim

Collecting member facts does not complete a Periodic Access Review. Only the separate current human attestation can satisfy the existing IAC-17 evidence path.

Token lifecycle

The customer controls rotation and revocation.

The Sythe Labs platform stores the token as an opaque encrypted secret and uses it only for the bounded reads in this guide. Cloudflare remains the source of truth for token status, expiry, and revocation.

Replace

Do not reuse a Global API Key, user-owned token, or broader existing token. Create a new account-owned token with only the same four Read permissions, the selected account, and all of its full, partial, and secondary public zones. Review the Cloudflare summary for extra grants, then replace it in the Sythe Labs platform. Required read validation runs before the connection switches, but it cannot confirm that no additional grants exist.

Expire

Replace a token before its Cloudflare expiry. The Sythe Labs platform does not extend, rotate, or renew customer tokens.

Revoke

Revoke the old token in the Cloudflare dashboard after a replacement succeeds, or revoke the current token when access must stop immediately. The Sythe Labs platform never revokes a Cloudflare token.

Disconnect

Disconnect in the Sythe Labs platform to stop scheduled syncs and remove Cloudflare-discovered inventory from active inventory. Revoke the token in Cloudflare separately. Manually managed inventory remains in place.

Clean up

After disconnecting, confirm the token is revoked in Cloudflare and remove customer-held copies under your credential-retention process. The Sythe Labs platform deletes its encrypted copy during disconnect.

Troubleshooting

Resolve a reported stable reason.

A failed connection or token replacement can report a stable reason, guide link, safe retry time, or request identifier. Match any reported reason to the action below. An asynchronous sync status retains only its safe failure message. Never copy the Cloudflare token into a message.

Check both permission categories

A token can show every Account permission and still fail zone reads. Cloudflare documents Account and Zone as separate permission categories with separate resource scopes. Compare the token summary with Cloudflare's API token permission reference.

Token is invalid or inactive

cloudflare_invalid_token

Create a new account-owned token with all four read permissions, the selected account, and all of its full, partial, and secondary public zones. Cloudflare displays the generated secret only once, so copy it directly into your password manager before replacing the token in the Sythe Labs platform.

Account cannot be accessed

cloudflare_account_inaccessible

Copy the selected Cloudflare Account ID again, then confirm that the token scope includes that account and all of its full, partial, and secondary public zones.

Account Settings Read is missing

cloudflare_missing_account_settings_read

Cloudflare separates Account and Zone permissions. Select All applies only to the resource category and resource scope where it was used; selecting all Account permissions does not add Zone permissions or zone resources. Create a replacement token with Account Settings Read under Account, the selected account, and separate Zone Read, DNS Read, and Zone Settings Read permissions covering all public zones, then replace the token in the Sythe Labs platform.

Zone Read is missing

cloudflare_missing_zone_read

Cloudflare separates Account and Zone permissions. Select All applies only to the resource category and resource scope where it was used; selecting all Account permissions does not add Zone permissions or zone resources. Create a replacement token with Zone Read under Zone and scope that Zone policy to all full, partial, and secondary public zones in the selected account.

DNS Read is missing

cloudflare_missing_dns_read

Cloudflare separates Account and Zone permissions. Select All applies only to the resource category and resource scope where it was used; selecting all Account permissions does not add Zone permissions or zone resources. Create a replacement token with DNS Read under Zone and scope that Zone policy to all full, partial, and secondary public zones in the selected account. DNS Read is required when the account contains a full or secondary zone.

Zone Settings Read is missing

cloudflare_missing_zone_settings_read

Cloudflare separates Account and Zone permissions. Select All applies only to the resource category and resource scope where it was used; selecting all Account permissions does not add Zone permissions or zone resources. Create a replacement token with Zone Settings Read under Zone and scope that Zone policy to all full, partial, and secondary public zones so the Sythe Labs platform can read HTTPS enforcement and minimum TLS settings.

No public zones are visible

cloudflare_no_zones_visible

Confirm that the selected account contains a full, partial, or secondary public zone and that the token scope includes all full, partial, and secondary public zones in that account.

Cloudflare rate limit was reached

cloudflare_rate_limited

If the failed request shows a safe retry time, wait until then. Otherwise, retry later after Cloudflare recovers. Do not broaden token permissions.

Cloudflare is temporarily unavailable

cloudflare_provider_unavailable

Retry from the Sythe Labs platform after Cloudflare service recovers. The existing connection and inventory remain unchanged after an incomplete sync.

Cloudflare returned an unsupported result

cloudflare_contract_changed

Cloudflare returned a response the Sythe Labs platform could not safely interpret. This does not by itself mean the token is invalid.

1Retry once from the signed-in Integrations page with the same Account ID and token.
2Wait for a pending Sythe Labs platform update before trying again. Do not broaden token permissions to resolve an unsupported response.
3If it repeats, send the stable reason, Cloudflare request ID, and platform request ID to Sythe Labs support. Do not include the token.

The connection changed during the sync

cloudflare_connection_changed

Reload the signed-in Integrations page and run a new sync against the current connection. Do not reuse a token that was replaced or revoked.

Need platform help?

Use the Sythe Labs support page and include the stable reason code and any safe request identifier shown in the Sythe Labs platform. For an asynchronous sync status, include only the safe failure message shown there. Do not include the token.