Cloudflare Integration Guide
One 3-minute step unlocks everything: domain inventory, redirects, TDS routing, and conversion attribution. Your DNS does not move; nothing about your Cloudflare setup changes.
What Connecting Cloudflare Actually Does
No DNS migration, no proxy, no nameserver change. We use a Cloudflare API token to read your zones and write redirect rules + Workers — the same edits you would make in the Cloudflare UI, applied through the API. Revoke the token from either side at any time; nothing of yours is mirrored elsewhere.
Once connected, zones appear as a domain table within seconds. Everything else — projects, sites, redirects, TDS rules, postback sources — reads from this inventory. The Cloudflare connection is what makes the rest of the panel meaningful.
Why Setup Is Not Six Permission Rows
Most CF integrations make you figure out 5-6 different API token permissions yourself (Zone Read, Zone DNS Edit, Workers Scripts Edit, and so on). We need just two — a small "bootstrap" token — and we generate every working token after that automatically.
You also do not have to copy your Account ID and token separately. On the Cloudflare "Test this token" screen, just copy the whole curl command and paste it into our form. We extract both pieces for you.
What You Get the Moment Sync Finishes
- Every Cloudflare zone in your account shows up as a row in Domains — searchable, filterable, with SSL/expiry/health visible at a glance.
- Per-domain inspector with DNS verification, registrar metadata, VirusTotal threat history, and traffic-anomaly monitoring — replacing four tabs you used to open separately.
- Redirects you create in 301.st deploy directly to Cloudflare Workers on the target zone — no manual zone selection, no per-rule copy-paste.
- TDS rules (Smart Shield filtering, SmartLink routing) run at the Cloudflare edge under your own zone — you do not operate the Worker code; 301.st generates and deploys it.
Before You Connect
- A Cloudflare account that owns the zones you want to manage. Free plan is enough for basic redirect work; Workers Paid recommended once TDS traffic scales.
- About 3 minutes to create the bootstrap API token. The drawer walks you through every Cloudflare screen.
- A rough mental list of which zones should appear after sync — useful as a sanity check that the connection wired the right account.
Quick Connect
- Open Integrations → click Add Cloudflare. The drawer opens on the Instructions tab.
- In the Cloudflare dashboard, create a token named
301.st Bootstrapwith two permissions: Account Settings: Read and API Tokens: Edit. - On the "Test this token" screen, copy the entire
curlcommand. Switch to the Connect tab in 301.st and paste it — Account ID and token are extracted automatically. - Click Save & verify token. Within a few seconds you should see your zones in the Domains tab — we created the working scoped tokens for you in the background.
FAQ
Why does the bootstrap token need "API Tokens: Edit"?
So 301.st can provision the actual scoped tokens it uses (Zone:Read, Zone:DNS:Edit, Workers:Scripts:Edit) without you authoring 6+ permission rows by hand. The bootstrap token itself never deploys redirects — it only mints the tokens that do, then sits idle until you re-sync.
Can I connect more than one Cloudflare account?
Yes. Each Cloudflare account becomes its own integration row. Common for agencies managing multiple client accounts side by side, or for affiliate teams separating staging domains from production.
What if I revoke the token in Cloudflare?
The next sync fails and the integration row goes red. Create a new bootstrap token in Cloudflare and paste it into Integrations → click the failing row → Edit. No data is lost — your projects, sites, redirects, and TDS rules wait for a working token.
Do I need Cloudflare to use 301.st at all?
For the core features — domain sync, redirects, TDS, postback attribution — yes. Namecheap and NameSilo integrations add expiry/registrar visibility into domains hosted elsewhere, but they do not deploy redirects.