Cloudflare Getting Started: Account, Keys, First Request (2026)

Getting started overview

Getting started with Cloudflare involves several foundational steps to integrate your web assets and begin utilizing their services. This process typically begins with account creation, followed by adding a website or application to the Cloudflare dashboard. Once a resource is added, you will configure its DNS settings to point to Cloudflare, enabling Cloudflare to manage traffic, apply security policies, and optimize performance. For programmatic interaction, generating API tokens is a critical step, allowing developers to automate configurations and integrate Cloudflare services into their existing workflows or applications.

Cloudflare offers a range of services, including Content Delivery Network (CDN), Distributed Denial of Service (DDoS) protection, Web Application Firewall (WAF), and DNS management. These services are accessible through the Cloudflare dashboard and its comprehensive API. The API supports various operations, from managing DNS records and firewall rules to deploying serverless functions with Cloudflare Workers. Cloudflare maintains extensive API documentation, providing detailed endpoints and request examples for developers seeking to integrate their systems programmatically. The platform also offers official SDKs in multiple programming languages to simplify API interactions, including Go SDK documentation and JavaScript SDK details.

Create an account and get keys

To begin using Cloudflare, you must first create an account on their platform. Cloudflare provides a free tier that supports basic website performance and security features, making it suitable for individuals and small businesses. Paid plans, such as the Pro plan starting at $20/month, offer enhanced features like advanced WAF and image optimization.

1. Sign up for a Cloudflare account: Navigate to the Cloudflare sign-up page and follow the prompts to create your account. You will need to provide an email address and create a password.
2. Add a site or application: After signing up, Cloudflare will prompt you to add your first website or application. Enter the domain name (e.g., example.com) you wish to protect and optimize. Cloudflare will then scan your existing DNS records.
3. Select a plan: Choose the appropriate plan for your needs. The free plan is usually sufficient for initial exploration and basic use cases.
4. Update nameservers: Cloudflare will provide you with two unique nameservers (e.g., john.ns.cloudflare.com, sara.ns.cloudflare.com). You must update your domain registrar's settings to use these Cloudflare nameservers. This step delegates DNS management to Cloudflare, allowing it to route traffic through its network. Instructions for this process are typically available from your domain registrar, such as Cloudflare's guide on changing nameservers.
5. Generate API tokens: For programmatic access, you need to generate an API token. Cloudflare recommends using API tokens instead of global API keys for enhanced security, as tokens can be scoped to specific permissions and resources. To generate a token:
   1. Log in to your Cloudflare dashboard.
   2. Navigate to My Profile > API Tokens.
   3. Click Create Token.
   4. Choose a template (e.g., "Edit DNS" for DNS management) or create a custom token with specific permissions. Ensure the token has the necessary permissions for the API calls you intend to make. For example, to manage DNS records, the token needs "Zone / DNS / Edit" permissions.
   5. Review and confirm the token creation. Copy the token immediately, as it will not be shown again. Store it securely.

Your first request

After setting up your account and obtaining an API token, you can make your first API request. A common initial request is to list DNS records for a zone (your domain). This example uses cURL, a widely available command-line tool for making HTTP requests.

Before making the request, you will need two pieces of information:

• Zone ID: The unique identifier for your domain (zone) within Cloudflare. You can find this in your Cloudflare dashboard under your domain's overview page (scroll down to the "API" section on the right sidebar). Alternatively, you can list all zones using the API with the Cloudflare Zones API documentation.
• API Token: The token you generated earlier with "Zone / DNS / Read" permissions, at a minimum.

Example: List DNS Records for a Zone

This cURL command retrieves all DNS records associated with your specified zone ID. Replace <YOUR_ZONE_ID> with your actual Zone ID and <YOUR_API_TOKEN> with your API token.

curl -X GET "https://api.cloudflare.com/client/v4/zones/<YOUR_ZONE_ID>/dns_records" \
     -H "Authorization: Bearer <YOUR_API_TOKEN>" \
     -H "Content-Type: application/json"

Expected Successful Response (JSON):

{
  "result": [
    {
      "id": "372e679540254bd0e5b6b068974d5300",
      "zone_id": "<YOUR_ZONE_ID>",
      "zone_name": "example.com",
      "name": "example.com",
      "type": "A",
      "content": "192.0.2.1",
      "proxiable": true,
      "proxied": true,
      "ttl": 1,
      "locked": false,
      "meta": {
        "auto_added": true,
        "source": "primary"
      },
      "created_on": "2024-01-01T12:00:00.000000Z",
      "modified_on": "2024-01-01T12:00:00.000000Z"
    },
    // ... other DNS records
  ],
  "success": true,
  "errors": [],
  "messages": [],
  "result_info": {
    "page": 1,
    "per_page": 20,
    "count": 1,
    "total_count": 1
  }
}

This response confirms that your API token is correctly configured and that you can successfully query your zone's DNS records. The "success": true field indicates a successful operation.

For more complex interactions, such as adding or updating DNS records, refer to the Cloudflare DNS Records API documentation.

Common next steps

Once you have successfully made your first API request, several common next steps can help you further leverage Cloudflare's capabilities:

• Explore the API reference: Dive deeper into the Cloudflare API Reference to understand the full range of available endpoints. This includes managing DNS records, configuring WAF rules, deploying Workers, and more.
• Implement API tokens with specific scopes: Refine your API token strategy by creating tokens with the minimum necessary permissions for each specific task. This enhances security by limiting the potential impact of a compromised token, as advised by Cloudflare's API token best practices.
• Utilize Cloudflare Workers: Explore Cloudflare Workers to deploy serverless functions at the edge. Workers allow you to intercept and modify HTTP requests and responses, perform authentication, or serve dynamic content without managing traditional servers. The Cloudflare Workers quickstart guide provides an entry point.
• Set up Web Application Firewall (WAF) rules: Configure WAF rules to protect your application from common web vulnerabilities and attacks. This involves defining custom rules or enabling managed rulesets through the Cloudflare dashboard or API.
• Integrate SDKs: For application development, consider using one of the official Cloudflare SDKs (e.g., JavaScript, Python, Go). SDKs abstract away the complexities of HTTP requests and authentication, providing language-specific methods for interacting with the API.
• Monitor analytics and logs: Cloudflare provides extensive analytics and logging capabilities. Monitor traffic patterns, security events, and performance metrics through the dashboard or by integrating with third-party logging services to gain insights into your web assets.

Troubleshooting the first call

When making your first API call, you might encounter issues. Here are common problems and their solutions:

• 401 Unauthorized:
  • Check your API token: Ensure the token is correct and hasn't expired. Verify that the Authorization header is correctly formatted as Bearer <YOUR_API_TOKEN>.
  • Token permissions: Confirm that your API token has the necessary permissions for the API endpoint you are trying to access. For listing DNS records, "Zone / DNS / Read" permission is required.
• 403 Forbidden:
  • Incorrect Zone ID: Double-check that the Zone ID in your request URL is accurate and belongs to your account.
  • IP restrictions: If your API token has IP address restrictions, ensure your current IP is whitelisted. You can review token settings under "My Profile > API Tokens" in the Cloudflare dashboard.
• 400 Bad Request:
  • Malformed URL or JSON: Review your cURL command for typos in the URL or incorrect JSON syntax if you are sending a POST/PUT request. Ensure all required headers, like Content-Type: application/json, are present for requests with a body.
  • Missing parameters: Some API endpoints require specific query parameters or request body fields. Consult the Cloudflare API documentation for the specific endpoint you are calling to verify required parameters.
• Nameserver propagation: If you've recently updated your nameservers, it can take up to 48 hours for changes to propagate globally. Until propagation is complete, some Cloudflare services, including API access to your zone, might not function as expected. You can check DNS propagation status using tools like What's My DNS.
• Rate limits: Cloudflare API has rate limits. If you are making many requests in a short period, you might receive a 429 Too Many Requests error. Implement exponential backoff or ensure your application adheres to the documented limits.

When troubleshooting, always refer to the specific error message returned by the API. Cloudflare's API responses often include detailed error codes and descriptions that can guide you to a solution.