Skip to content
DNSmigrator
stableDNS stableCloud platformSetup guide checked 2026-09-27

Cloudflare DNS

Cloudflare API token setup: create a scoped API token that can read (and, to apply, edit) DNS records for the zones you're moving.

On this page

Cloudflare API token permissions

Credential type
API token
Preview access
Zone · DNS · Read
Apply access
Zone · DNS · Edit
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

To let us create a zone that doesn't exist yet, also add Zone · Zone · Edit, set Zone Resources to All zones from an account, and fill in the Account ID.

DNSControl id

creds.json TYPE
{
  "TYPE": "CLOUDFLAREAPI"
}

Create credentials

Create a scoped API token that can read (and, to apply, edit) DNS records for the zones you're moving.

Access you'll grant

Preview

Zone · DNS · Read

Apply

Zone · DNS · Edit

To let us create a zone that doesn't exist yet, also add Zone · Zone · Edit, set Zone Resources to All zones from an account, and fill in the Account ID.

Before you start

  • A Cloudflare account with access to the zones. Any plan, including Free, works.

Setup steps

0 of 6 done

  1. Open API Tokens

    Sign in to the Cloudflare dashboard and go to My Profile → API Tokens, then select Create Token.

    Open API Tokens

  2. Start from the Edit zone DNS template

    Next to Edit zone DNS, select Use template. It grants Zone · DNS · Edit, which covers the preview and the apply. For a preview only, choose Create Custom Token instead and add Zone · DNS · Read.

    PreviewZone · DNS · Read
    ApplyZone · DNS · Edit

    Screenshot: Cloudflare Docs, CC BY 4.0

  3. Limit the token to your zones

    Under Zone Resources, choose Include → Specific zone and pick each zone you're migrating, or All zones from an account. Leave Client IP Address Filtering empty: requests come from our servers.

  4. Review and create

    Select Continue to summary, check the zones and permissions, then select Create Token.

    Screenshot: Cloudflare Docs, CC BY 4.0

  5. Copy the token

    Cloudflare shows the secret once. Copy it and paste it into API token here. New tokens start with cfut_.

    Screenshot: Cloudflare Docs, CC BY 4.0

  6. Add the Account ID (optional)

    Only needed if we should create the zone at Cloudflare for you. It's on the zone's Overview page under API → Account ID, and in the account home URL: dash.cloudflare.com/<account ID>.

    Cloudflare: find account and zone IDs

Troubleshooting

“The API token is not active” or “Invalid API Token”

The token was rolled, expired (check its TTL) or copied incompletely. Create a new one and paste the whole value.

The zone list is empty

Zone Resources doesn't include the zone. Edit the token and add it under Zone Resources.

Connected with read access only

The token has DNS Read but not DNS Edit. Edit the token, change DNS to Edit, and check access again.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
API tokenapiTokenRequiredShown once, when you create the token. New tokens start with cfut_.
Account IDaccountIdOptional32 hex characters. Only needed to create zones: zone Overview → API → Account ID.

Capabilities

Create zones
Yes
List zones
Yes
DNSSEC
Managed through the API
Minimum TTL
60 seconds
Apex CNAME
Supported through flattening
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • PTR
  • DS
  • HTTPS
  • SVCB
  • TLSA
  • SSHFP
  • NAPTR
  • LOC
  • CERT
  • URI

Cloudflare-only types

  • CF_REDIRECT
  • CF_TEMP_REDIRECT
  • CF_SINGLE_REDIRECT
  • CF_WORKER_ROUTE

These records need translation or review when you move to another provider.

Caveats

  • Proxied (orange-cloud) records hide the origin IP. Moving them to another provider sends traffic straight to the origin.
  • Apex CNAMEs are flattened by Cloudflare. Other providers need an ALIAS record or static A/AAAA records instead.
  • Cloudflare Registrar only allows Cloudflare nameservers, so domains registered there must be transferred out first.

Troubleshooting

“The API token is not active” or “Invalid API Token”
The token was rolled, expired (check its TTL) or copied incompletely. Create a new one and paste the whole value.
The zone list is empty
Zone Resources doesn't include the zone. Edit the token and add it under Zone Resources.
Connected with read access only
The token has DNS Read but not DNS Edit. Edit the token, change DNS to Edit, and check access again.

Related links

Cloudflare DNS migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Route 53 → CloudflareAzure DNS → CloudflareCloud DNS → CloudflareGoDaddy → Cloudflare