> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ravenna.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Setup

> Connect Cloudflare Access to Ravenna using a Cloudflare API token and account ID.

Connect Cloudflare Access to Ravenna using a scoped Cloudflare API token and your Cloudflare account ID.

## Prerequisites

Before you begin, ensure you have:

* Cloudflare account access with permission to create API tokens
* Your Cloudflare account ID (visible in the URL of your Cloudflare dashboard)
* Ravenna Organization Admin permissions

## Setup guide

### Create the Cloudflare API token

<Steps>
  <Step title="Open the API Tokens page">
    Sign in to the [Cloudflare dashboard](https://dash.cloudflare.com) and go to **My Profile > API Tokens**.
  </Step>

  <Step title="Create a token">
    Click **Create Token** and choose **Create Custom Token**.
  </Step>

  <Step title="Grant permissions">
    Add the following account-scoped permissions so Ravenna can sync applications, groups, and users:

    * **Access: Organizations, Identity Providers, and Groups**: Read and Edit
    * **Access: Apps and Policies**: Read
    * **Access: Users**: Read

    Scope the token to the Cloudflare account you want to connect.
  </Step>

  <Step title="Copy the token">
    Finish creating the token and copy the value.

    <Warning>
      Store the token securely. Cloudflare only shows it once.
    </Warning>
  </Step>
</Steps>

<Callout icon="link" color="#3B82F6">
  For more details, see [Cloudflare's API token guide](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/).
</Callout>

### Find your Cloudflare account ID

Open any page in the Cloudflare dashboard for the account you want to connect. The account ID is the string after `/accounts/` in the URL, for example:

```text theme={"system"}
https://dash.cloudflare.com/<account-id>/...
```

### Connect Cloudflare Access in Ravenna

<Steps>
  <Step title="Navigate to integrations">
    Go to **Settings > Integrations**.
  </Step>

  <Step title="Select Cloudflare">
    Find **Cloudflare** in the available integrations and click **Connect**.
  </Step>

  <Step title="Enter credentials">
    Provide the following:

    <ParamField path="apiToken" type="string" required>
      The Cloudflare API token you created above.
    </ParamField>

    <ParamField path="accountId" type="string" required>
      Your Cloudflare account ID.
    </ParamField>
  </Step>

  <Step title="Complete setup">
    Click **Add Cloudflare** to finish. Ravenna validates the credentials and starts syncing Cloudflare Access applications, groups, and users.
  </Step>
</Steps>

Once syncing completes, Cloudflare applications and groups become selectable in access policy approvers, workflow actions, and agent rules, just like other access-provider integrations.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid credentials error">
    **Cause**: The API token or account ID is wrong, or the token was revoked.

    **Solution**:

    * Verify the token was copied exactly, with no extra whitespace.
    * Confirm the account ID matches the account the token is scoped to.
    * Regenerate the token in Cloudflare if you rotated it recently.
  </Accordion>

  <Accordion title="Applications or groups not syncing">
    **Cause**: The token is missing read access to Access apps, groups, or users.

    **Solution**:

    * Edit the token in Cloudflare and confirm the three permissions listed above are present.
    * Trigger a resync from the integration page in **Settings > Integrations**.
    * If a resource type has zero items in Cloudflare, Ravenna keeps the integration connected and reports the resource as empty.
  </Accordion>

  <Accordion title="Cannot add group memberships from Ravenna">
    **Cause**: The token has read access to Access groups but not edit access.

    **Solution**:

    * Update the token to grant **Access: Organizations, Identity Providers, and Groups, Edit**.
    * Disconnect and reconnect the integration with the new token.
  </Accordion>
</AccordionGroup>


## Related topics

- [Setup](/integrations/sso/setup.md)