Docs / Clouds
Cloudflare
Connect a Cloudflare account with OAuth to manage DNS, Workers, Pages, R2, D1, KV and more.
Pangea connects to Cloudflare with OAuth. You choose what Pangea may manage, then authorize in your browser. There is no API token to create, scope or paste.
Connect
In Connectors → Connect → Cloudflare, set an access level for each category before you authorize. Each one is Off, Read or Write:
| Category | Covers | Default |
|---|---|---|
| DNS & zones | Zones, records, registrar | Write |
| Developer platform | Workers, Containers, Pages, R2, D1, KV, Queues | Write |
| AI | Workers AI, AI Gateway, AI Search | Off |
| Analytics & logs | Analytics, Logpush, Radar | Off |
| Application security | WAF, bots, DDoS, Page Shield | Off |
| Cache & SSL | Cache settings, purge, certificates | Off |
| Zero Trust | Access, Gateway, Tunnels, WARP | Off |
| Email Routing, Email Security, sending | Off | |
| Media | Images, Stream, Calls | Off |
| Network services | Load balancing, Magic Transit/WAN, IP prefixes | Off |
| Rules & configuration | Rulesets, redirects, transforms, custom pages | Off |
| Account | Settings, members, API tokens, notifications | Off |
| Other | Artifacts, resource sharing | Off |
Read requests only the category's read-only scopes. Write requests every scope in it. Anything left Off is never requested, so Cloudflare itself refuses it. The boundary does not depend on Pangea.
A small read-only baseline is always requested for account discovery: account settings, user details, memberships and zone read. Pangea also asks for offline access so it can refresh tokens.
Click Connect with Cloudflare to open Cloudflare's authorization page in your browser. Tokens are stored encrypted and refreshed automatically. You can revoke them anytime in your Cloudflare account.
R2 object access
Browsing buckets uses the OAuth grant. Listing, uploading, downloading and deleting objects uses R2's S3-compatible API, which needs its own credential. Create an R2 Access Key ID and Secret Access Key in the Cloudflare dashboard under R2 → Manage API tokens, then add them to the binding from the R2 page in Pangea. Bucket-level operations work without them.
In the Pangea app
A bound account gets its own pages:
- Zones and DNS: browse zones and manage A, CNAME, MX and other records.
- Workers: scripts, routes, cron triggers and their bindings.
- Pages: projects, deployments and deployment logs.
- R2: buckets, plus the object browser when S3 credentials are added.
- D1: databases and their schema.
- KV: namespaces, keys and values.
- IAM: what this binding can actually reach, given the scopes you granted.
What the agent can do for you
The agent can read and change anything within the scopes you granted:
- "Point
app.example.comat the new load balancer." It finds the zone, shows the record change and applies it once authorized. - "Why isn't
api.example.comresolving?" It reads the zone's records and correlates them with your connected cloud accounts to trace where traffic should land. - "Which Worker is throwing after this morning's deploy?" It reads the script, its routes and the deployment history.
DNS is also part of the bigger picture. When you ask "what's exposing api-prod to the internet?", the agent traces DNS, ingress and firewall rules together.
Permissions and authorization
Team Administrators connect and remove this binding and can restrict it with a member allow-list. Select the connection for the conversation before you ask the agent to use it. Cloudflare's scopes stay the outer limit, whatever the prompt or permission mode.
Individual actions follow Auto Mode and Full Access. Significant cloud infrastructure work uses plans. A routine API action does not create a plan on its own, so say so explicitly when you want to review changes before they go live.
Good to know
- Grant Read rather than Write for anything you only want to look at. It is the one boundary the agent cannot argue its way past.
- Revoking the authorization in Cloudflare invalidates the binding immediately. Reconnect in Pangea to restore it.