Skip to main content
Connect using a Cloudflare API token. Requires an account with permission to create API tokens and to read Cloudflare Access configuration.

​
Prerequisites

Before you begin, make sure you have:
  • A Cloudflare account with Zero Trust Access configured
  • Permission to create API tokens on that account
  • Your Cloudflare account ID
  • Ravenna organization admin permissions

​
Setup guide

​
Find your account ID

1

Open the Cloudflare dashboard

Log in to dash.cloudflare.com and select your account
2

Copy the ID from the URL

Your account ID is the 32-character string in the dashboard URL:
It is also listed as Account ID on the account overview page.

​
Create an API token

1

Open the API tokens page

Go to dash.cloudflare.com/profile/api-tokens
2

Create a custom token

Select Create Token, then Create Custom Token. Give it a descriptive name such as Ravenna Integration.
3

Add the required permissions

All three are account-scoped.
Edit on the groups permission is required for the workflow actions that add and remove users. A Read token syncs data but cannot change group membership.
4

Scope the token to your account

Under Account Resources, include the account you copied the ID from
5

Create and copy the token

Select Continue to summary, then Create Token, and copy the value.
Cloudflare shows the token once. Copy it before leaving the page, because it cannot be retrieved later.
For more details, see Cloudflare’s guide to creating API tokens

​
Add the integration in Ravenna

1

Navigate to integrations

Go to Settings > Integrations
2

Select Cloudflare

Find Cloudflare and select Connect
3

Enter your credentials

​
string
required
The API token you created above
​
string
required
Your Cloudflare account ID
​
string
How often Ravenna resyncs applications, users, and groups. Defaults to every 24 hours.
4

Complete setup

Select Add Cloudflare. Ravenna validates the token against your account, then starts the first sync of applications, users, and groups.

​
Troubleshooting

Cause: The token value is wrong, or it has been revoked or rotated in Cloudflare.Solution:
  • Check for extra spaces or a truncated paste
  • Confirm the token is still listed and active on the Cloudflare API tokens page
  • Create a new token and reconnect if the original was rotated
Cause: The token is missing the Access: Organizations, Identity Providers, and Groups permission.Solution:
  • Edit the token in Cloudflare and add the three permissions listed above
  • Use Edit, not Read, on the groups permission if you plan to use workflow actions
  • Resync from the integration page after updating the token, with no need to disconnect
Cause: The account ID is mistyped, or the token is scoped to a different account.Solution:
  • Recopy the ID from the dashboard URL
  • Confirm the token’s Account Resources include that account
Cause: The token can reach some Cloudflare Access endpoints but not others.Behavior: A permission error on one resource does not fail the whole sync. Ravenna logs the problem, syncs that resource as empty, and continues with the rest.Solution:
  • Add the missing permission to the token
  • Resync from the integration page and confirm counts on each resource
Cause: The group’s include rules do not name individual email addresses.Solution: Ravenna derives membership from email include rules only. A group that grants access through an email domain, an everyone rule, or an identity provider rule syncs with no members. Add email rules to any group you want Ravenna to report on or manage.
Learn more about Cloudflare Access workflow actions
Last modified on September 17, 2026