Skip to main content
Connect Cloudflare Access to Ravenna using a scoped Cloudflare API token and your Cloudflare account ID.

​
Prerequisites

Before you begin, ensure you have:
  • Cloudflare account access with permission to create API tokens
  • Your Cloudflare account ID (visible in the URL of your Cloudflare dashboard)
  • Ravenna Organization Admin permissions

​
Setup guide

​
Create the Cloudflare API token

1

Open the API Tokens page

Sign in to the Cloudflare dashboard and go to My Profile > API Tokens.
2

Create a token

Click Create Token and choose Create Custom Token.
3

Grant permissions

Add the following account-scoped permissions so Ravenna can sync applications, groups, and users:
  • Access: Organizations, Identity Providers, and Groups: Read and Edit
  • Access: Apps and Policies: Read
  • Access: Users: Read
Scope the token to the Cloudflare account you want to connect.
4

Copy the token

Finish creating the token and copy the value.
Store the token securely. Cloudflare only shows it once.
For more details, see Cloudflare’s API token guide.

​
Find your Cloudflare account ID

Open any page in the Cloudflare dashboard for the account you want to connect. The account ID is the string after /accounts/ in the URL, for example:

​
Connect Cloudflare Access in Ravenna

1

Navigate to integrations

Go to Settings > Integrations.
2

Select Cloudflare

Find Cloudflare in the available integrations and click Connect.
3

Enter credentials

Provide the following:
​
string
required
The Cloudflare API token you created above.
​
string
required
Your Cloudflare account ID.
4

Complete setup

Click Add Cloudflare to finish. Ravenna validates the credentials and starts syncing Cloudflare Access applications, groups, and users.
Once syncing completes, Cloudflare applications and groups become selectable in access policy approvers, workflow actions, and agent rules, just like other access-provider integrations.

​
Troubleshooting

Cause: The API token or account ID is wrong, or the token was revoked.Solution:
  • Verify the token was copied exactly, with no extra whitespace.
  • Confirm the account ID matches the account the token is scoped to.
  • Regenerate the token in Cloudflare if you rotated it recently.
Cause: The token is missing read access to Access apps, groups, or users.Solution:
  • Edit the token in Cloudflare and confirm the three permissions listed above are present.
  • Trigger a resync from the integration page in Settings > Integrations.
  • If a resource type has zero items in Cloudflare, Ravenna keeps the integration connected and reports the resource as empty.
Cause: The token has read access to Access groups but not edit access.Solution:
  • Update the token to grant Access: Organizations, Identity Providers, and Groups, Edit.
  • Disconnect and reconnect the integration with the new token.
Last modified on September 16, 2026