The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Make a Cloudflare API request by sending an HTTPS request to https://api.cloudflare.com/client/v4/, authenticating with Authorization: Bearer YOUR_API_TOKEN, and supplying the identifiers, parameters, method and JSON body required by the specific endpoint. Cloudflare recommends narrowly scoped API tokens rather than legacy API keys. The endpoint schema is the authority for the exact path, permissions and payload.
The request pattern
Every Version 4 API call has four decisions: the endpoint URL, HTTP method, authentication, and endpoint-specific data. A typical read request looks like this:
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID"
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"Set the token in an environment variable or a secret manager, not directly in source code or shell history. Replace $ZONE_ID with the zone identifier for the site you intend to query. A write operation may require POST, PUT, PATCH or DELETE, a JSON body, and different permissions.
1. Find the endpoint and its scope
Start in Cloudflare’s API reference and locate the operation for the resource you need. Confirm all of the following before writing code:
Recommended Free Tools
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
- Resource scope: whether the operation is user-, account-, zone- or resource-scoped.
- Path identifiers: such as an account ID, zone ID, DNS record ID or other object ID.
- HTTP method: the method controls whether you read, create, update or delete.
- Permission group and level: the token may need a specific Read or Edit permission.
- Query parameters and body schema: names, types, required fields and allowed values.
Do not infer a payload from a similar endpoint. Cloudflare’s schema for the operation determines the required fields and supported parameters.
2. Create a least-privilege API token
Choose a token instead of an API key
Cloudflare’s API overview says, “Whenever possible, use API tokens to interact with the Cloudflare API.” Tokens can be limited to particular permission groups and resources, and can include an expiration time and client-IP restrictions. API keys have broader limitations and are a weaker default for routine automation.
Configure the token in the dashboard
- Open your Cloudflare dashboard and go to the API-token creation area.
- Select a user token, or an account token when the endpoint supports account tokens.
- Add only the permission group and Read or Edit level required by the operation.
- Restrict the token to the required account, zone or other resource. Add an expiration time and client-IP filtering when appropriate.
- Create the token and copy the secret immediately. Cloudflare displays the secret only once.
Store it in a protected secret store or environment variable. Never commit it to Git, put it in browser JavaScript, paste it into an issue, or print it in logs. If someone may have seen the value, revoke it and create a replacement.
3. Make a first request with cURL
Set credentials in your shell, then call the endpoint:
export CLOUDFLARE_API_TOKEN='replace-with-your-token'
export ZONE_ID='replace-with-your-zone-id'
curl --fail-with-body
"https://api.cloudflare.com/client/v4/zones/$ZONE_ID"
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
--header "Content-Type: application/json"The Content-Type header is harmless on a read request and required by many JSON-writing endpoints. Add --request POST, --data @payload.json or endpoint-specific query parameters only when the schema calls for them.
Quote URLs correctly in a shell
Always quote a URL that contains a query string. Double quotes allow environment-variable expansion:
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records?type=A&page=1&per_page=50"
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"Single quotes prevent shell expansion, so use them only when the URL contains no variables. If a query value itself contains spaces or shell metacharacters, encode it or use the endpoint’s documented syntax.
4. Understand the JSON response
Cloudflare responses use a JSON envelope. Successful calls generally provide a Boolean success value, a result object or array, and result_info when pagination applies. Errors include an errors array with codes and messages. Check both the HTTP status and the JSON success value; do not treat an HTTP response body as proof that an operation succeeded.
For readable command-line output, pipe a response through jq:
curl --silent --show-error
"https://api.cloudflare.com/client/v4/zones/$ZONE_ID"
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" | jqFor automation, log the status code, Cloudflare error codes and a request correlation identifier if returned, but redact authorization headers and sensitive response fields.
Runnable language examples
Python with requests
import os
import requests
base = "https://api.cloudflare.com/client/v4"
token = os.environ["CLOUDFLARE_API_TOKEN"]
zone_id = os.environ["ZONE_ID"]
response = requests.get(
f"{base}/zones/{zone_id}",
headers={
"Authorization": f"Bearer {token}",
"Accept": "application/json",
},
timeout=30,
)
response.raise_for_status()
payload = response.json()
if not payload.get("success"):
raise RuntimeError(payload.get("errors"))
print(payload["result"])For a JSON write, use the method documented for that endpoint and pass json={...} to requests. Keep connect and read timeouts finite, and implement bounded retries only for transient failures.
Node.js with fetch
const token = process.env.CLOUDFLARE_API_TOKEN;
const zoneId = process.env.ZONE_ID;
const response = await fetch(
`https://api.cloudflare.com/client/v4/zones/${zoneId}`,
{
headers: {
Authorization: `Bearer ${token}`,
Accept: "application/json"
}
}
);
const payload = await response.json();
if (!response.ok || !payload.success) {
throw new Error(JSON.stringify(payload.errors ?? payload));
}
console.log(payload.result);On a write request, add method, Content-Type: application/json and a serialized JSON body exactly as the endpoint schema specifies.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
SDKs and Terraform
Use a first-party SDK when your application makes many related calls in Go, TypeScript or Python and you want typed models, authentication helpers and consistent error handling. Use Terraform when Cloudflare resources belong to an infrastructure-as-code workflow and should be reviewed and applied as configuration. For a one-off inspection or a small script, cURL is usually the shortest path. Library versions change, so check the current versions shown in Cloudflare’s API reference before pinning dependencies.
Parameters, bodies and identifiers
Path and query data
Path IDs identify the parent and target resource; query parameters filter, sort or paginate a collection. The names are endpoint-specific. Do not substitute a zone name for a zone ID unless that endpoint explicitly accepts it.
JSON request bodies
Validate required fields before sending a write. Preserve the documented data types, enum values and nesting. For partial updates, use the endpoint’s specified patch semantics rather than assuming omitted fields will be preserved. Test destructive methods against a non-production resource first.
Pagination
Collection endpoints commonly expose page and per_page, and may support order and direction. Read result_info to discover the available page count and totals for that endpoint. Keep requesting pages until the API indicates there are no more results. Excessively large page sizes can time out, so choose a moderate value and measure response time.
Rate limits and reliable clients
Cloudflare’s rate-limit page, last updated August 25, 2026, lists a Client API limit of 1,200 requests per five-minute period per user or account token and 200 requests per second per IP. Exceeding the global limit produces HTTP 429 responses and blocks API calls for the next five minutes. These are published operational limits, not a performance guarantee; check the live page before deploying a high-volume integration.
Inspect Ratelimit, Ratelimit-Policy and retry-after headers. On 429, stop sending requests, honor retry-after when present, then retry with exponential backoff and jitter. Do not retry a non-idempotent write blindly: determine whether the first request was accepted before repeating it. Cache stable reads, batch work where an endpoint permits it, and keep concurrency below the documented limit.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Authentication failures and other troubleshooting
401 or an invalid-token message
- Confirm the header is exactly
Authorization: Bearer TOKEN; do not use a query-string token. - Check that the environment variable is populated and has no pasted whitespace or newline.
- Call
/user/tokens/verifywith the same Bearer header to confirm that the token is active. - If the secret was exposed, revoke it and issue a new token.
403 or a permission error
- Compare the endpoint’s required permission group with the token’s permissions.
- Check that the token resource scope includes the target account or zone.
- Confirm your Cloudflare user role permits the operation.
- Verify that you used the correct account or zone ID.
404 or an empty result
Check the API path, parent ID and object ID. A valid token cannot find a resource in a different account or zone scope. Some list endpoints return an empty result for a valid filter, so distinguish that from an incorrect identifier by querying the parent resource.
400 or validation errors
Read every entry in the response’s errors array. Compare spelling, capitalization, data types, required fields and enum values with the endpoint schema. Send JSON with the correct Content-Type and remove unsupported fields.
429 or timeouts
Reduce concurrency, paginate with smaller pages, and follow the rate-limit headers. A timeout can result from an oversized page or a slow operation; do not automatically repeat a write until you know its outcome.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Security and lifecycle checklist
- Use an API token with the smallest permission set and resource scope.
- Set an expiration date and IP restrictions when your deployment allows them.
- Keep secrets in a managed store; rotate them and remove unused tokens.
- Redact tokens from CI logs, exception traces and support bundles.
- Separate read-only monitoring credentials from edit-capable deployment credentials.
- Review the live Cloudflare documentation for changing limits and authentication policy.
Cloudflare’s rate-limit page lists a maximum of 50 user API tokens per user and 500 account API tokens per account. Service Key authentication was scheduled for removal on September 30, 2026, after deprecation on March 19, 2026; verify Cloudflare’s current deprecation status before relying on Service Keys.
Or skip the browser setup
If your project also needs automated reference images of Cloudflare pages, ScreenshotNeo provides a single website-screenshot request instead of maintaining a browser. Before capture it accepts cookie or consent banners and removes more than 60 known consent platforms, newsletter popups and chat widgets; each step can be disabled. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads and cache hits are not billed, and the response identifies the result with X-Page-Verdict and X-Billed headers. Its MCP server exposes take_screenshot, get_page_info and capture_pdf to Claude, Cursor and other MCP clients.
Using the API is one GET request:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://www.cloudflare.com -o shot.webpSee the ScreenshotNeo API documentation for the other 63 capture options, including full-page lazy-image loading, CSS-selector element capture, device presets, dark mode, custom CSS or JavaScript, waits, request blocking, headers, cookies, geolocation, PDF output, caching, signed links, asynchronous webhooks, bulk capture and usage reporting. The free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
FAQ
Can I put a Cloudflare API token in a frontend application?
No. Browser-delivered code exposes its credentials to every visitor. Proxy the operation through a server that keeps the token in a secret store and enforces your own authorization.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Should every request be retried automatically?
No. Retries are appropriate only for safely repeatable operations or when the API explicitly supports an idempotency strategy. A repeated create or delete can produce unintended changes.
When should I use an account token instead of a user token?
Use an account token when the endpoint supports it and the automation belongs to an account rather than an individual. Confirm support and scope in that endpoint’s documentation; not every operation accepts both token types.
How can I test a new token without changing anything?
Use the token verification endpoint first, then call a read-only endpoint against a non-production account or zone. Add edit permissions only after the read path works.
Frequently Asked Questions
Can I put a Cloudflare API token in a frontend application?
No. Browser-delivered code exposes its credentials to every visitor. Proxy the operation through a server that keeps the token in a secret store and enforces your own authorization.
Should every request be retried automatically?
No. Retry only safely repeatable operations, or use an idempotency strategy documented for that endpoint.
When should I use an account token instead of a user token?
Use an account token when the endpoint supports it and the automation belongs to an account rather than an individual; verify support in the endpoint documentation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
