Connect Your Cloudflare Account
Connect a project-owned Cloudflare account to manage its DNS zones and simplify app custom-domain setup.
Overview
The Cloudflare integration lets a project manage DNS records in your own Cloudflare account. It is useful when you want to point an app at a custom hostname without copying DNS instructions between dashboards.
This connection is separate from Cosmoner-managed DNS. It can access only the Cloudflare zones available to the credential you connect, and it never grants access to Cosmoner-managed zones. The credential is associated with the project, so project members use the same connection; it is not tied to an individual user's Cloudflare account.
Before You Connect
Create a Cloudflare API token with access only to the zones you intend to manage. At a minimum, grant:
| Permission | Why it is needed |
|---|---|
| Zone → DNS → Edit | Create, update, and delete DNS records. |
| Zone → Zone → Read | List the zones available to the project and validate the selected zone. |
Scope the token's Zone Resources to the specific zone or zones you want this project to manage. Do not use your Cloudflare Global API Key. Treat the token like a password: do not share it, commit it to source control, or put it in an app environment variable.
You need project write access to connect, change settings, or change records. Viewers can see the connection and records but cannot modify them.
Connect and Manage the Connection
- Open Project → Integrations → Cloudflare.
- Select Connect with API token, paste the scoped token, and connect.
- Confirm the displayed Cloudflare account and choose a zone to inspect its records.
The connection page shows whether a Cloudflare account is connected, the connection method, and the account name when Cloudflare provides one. It never displays the token after you submit it.
Use Reconnect with token to replace a token that has expired or needs different zone access. Select Disconnect to remove the stored project credential. Disconnecting stops future DNS management and automatic DNS changes, but it does not delete DNS records that already exist in Cloudflare.
Optional OAuth connection
Some deployments may offer Connect with Cloudflare instead of, or alongside, an API-token connection. This option appears only when Cloudflare OAuth has been configured for that deployment. It opens Cloudflare's authorization screen and returns you to the integration page after completion.
If the option is not shown, use a scoped API token. OAuth availability does not affect API-token connections or DNS management.
Manage DNS Records
After connecting, select one of the zones exposed by your Cloudflare credential. You can create, edit, and delete supported records directly from the page. Changes take effect in the selected Cloudflare zone.
The integration supports A, AAAA, CNAME, MX, TXT, NS, SRV, and CAA records.
| Record type | Content format |
|---|---|
A, AAAA, CNAME, TXT, NS | The normal record value, such as an IP address or hostname. |
MX | Mail host in Content, with a numeric Priority entered separately. |
SRV | priority weight port target — for example, 10 5 443 service.example.com. |
CAA | flags tag value — for example, 0 issue letsencrypt.org. |
Use 1 for Cloudflare's automatic TTL. Only A, AAAA, and CNAME records can be proxied. Proxied records must use the automatic TTL. DNS propagation is controlled by DNS resolvers and Cloudflare, so changes may not be visible everywhere immediately.
Deleting a record is permanent in Cloudflare. Confirm the hostname and record type before you delete it.
Automatic DNS for App Domains
The Automatic DNS switch is off by default. When enabled, changing an eligible app custom domain automatically creates the required DNS record in a matching zone from the connected Cloudflare account.
When the switch is off, Cosmoner asks for confirmation during the app domain flow instead. You can approve the proposed record with one click or choose to add it yourself later. The app domain is saved either way; if you add the record manually, follow the displayed DNS instructions and complete any required verification.
Automatic DNS is available only when all of the following are true:
- The app uses an eligible external custom domain.
- The connected Cloudflare account has a zone matching that hostname.
- The project connection has permission to edit that zone.
If record creation fails, the domain change remains saved and the UI reports that DNS still needs attention. You can add the record manually or retry after correcting the Cloudflare token's permissions.
Security and Ownership
- DNS changes are made only in the zones exposed by the connected customer credential.
- The project credential is stored securely and is not returned by the API or shown in the dashboard.
- Replacing or disconnecting a project connection affects only that project's ability to manage its customer-owned zones.
- Existing records remain owned by and visible in your Cloudflare account at all times.