Cloudflare Integration Guide
One 3-minute step unlocks everything: domain inventory, redirects, TDS routing, and conversion attribution. Your DNS does not move; nothing about your Cloudflare setup changes.
What Connecting Cloudflare Actually Does
No DNS migration, no proxy, no nameserver change. We use a Cloudflare API token to read your zones and write redirect rules + Workers — the same edits you would make in the Cloudflare UI, applied through the API. Revoke the token from either side at any time; nothing of yours is mirrored elsewhere.
Once connected, zones appear as a domain table within seconds. Everything else — projects, sites, redirects, TDS rules, postback sources — reads from this inventory. The Cloudflare connection is what makes the rest of the panel meaningful.
Why Setup Is Not Six Permission Rows
Most "connect your Cloudflare" flows make you author 5–6 separate token permissions yourself (Zone:Read, Zone:DNS:Edit, Workers:Scripts:Edit, and so on) and pray you got the scope right. 301.st asks for two permissions on a small "bootstrap" token and provisions every working scoped token from there automatically.
You do not even hunt for your Account ID. Cloudflare's "Test this token" screen produces a curl example — paste the whole command into the Connect form and 301.st extracts both the Account ID and the token. Two clicks of friction become zero.
What You Get the Moment Sync Finishes
- Every Cloudflare zone in your account shows up as a row in Domains — searchable, filterable, with SSL/expiry/health visible at a glance.
- Per-domain inspector with DNS verification, registrar metadata, VirusTotal threat history, and traffic-anomaly monitoring — replacing four tabs you used to open separately.
- Redirects you create in 301.st deploy directly to Cloudflare Workers on the target zone — no manual zone selection, no per-rule copy-paste.
- TDS rules (Smart Shield filtering, SmartLink routing) run at the Cloudflare edge under your own zone — you do not operate the Worker code; 301.st generates and deploys it.
Before You Connect
- A Cloudflare account that owns the zones you want to manage. Free plan is enough for basic redirect work; Workers Paid recommended once TDS traffic scales.
- About 3 minutes to create the bootstrap API token. The drawer walks you through every Cloudflare screen.
- A rough mental list of which zones should appear after sync — useful as a sanity check that the connection wired the right account.
Quick Connect
- Open Integrations → click Add Cloudflare. The drawer opens on the Instructions tab with screenshots for every Cloudflare step.
- In the Cloudflare dashboard create a token named
301.st Bootstrapwith two permissions: Account Settings: Read and API Tokens: Edit. - On the Cloudflare "Test this token" screen, copy the entire
curlcommand. Switch to the Connect tab in 301.st and paste it — Account ID and token are extracted automatically. - Click Save & verify token. Within a few seconds your zones appear in Domains. The scoped tokens we actually use to read/write were created in the background; you never see them.
FAQ
Why does the bootstrap token need "API Tokens: Edit"?
So 301.st can provision the actual scoped tokens it uses (Zone:Read, Zone:DNS:Edit, Workers:Scripts:Edit) without you authoring 6+ permission rows by hand. The bootstrap token itself never deploys redirects — it only mints the tokens that do, then sits idle until you re-sync.
Can I connect more than one Cloudflare account?
Yes. Each Cloudflare account becomes its own integration row. Common for agencies managing multiple client accounts side by side, or for affiliate teams separating staging domains from production.
What if I revoke the token in Cloudflare?
The next sync fails and the integration row goes red. Create a new bootstrap token in Cloudflare and paste it into Integrations → click the failing row → Edit. No data is lost — your projects, sites, redirects, and TDS rules wait for a working token.
Do I need Cloudflare to use 301.st at all?
For the core features — domain sync, redirects, TDS, postback attribution — yes. Namecheap and NameSilo integrations add expiry/registrar visibility into domains hosted elsewhere, but they do not deploy redirects.