Use a scoped Cloudflare API token for Domain Nexus, with access to the account and zones your company intends to manage. The token used here is a provider credential. It is separate from the API key your resellers use to call our registrar API.
IN THIS ARTICLE
Which Cloudflare token permissions does this connection need?
In Cloudflare's profile API-token area, create a token for the DNS work you need. Include zone visibility and DNS edit permissions for the selected zones. Creating new Cloudflare zones or managing DNSSEC may require additional permissions and account access beyond an existing-zone DNS edit template. Prefer a deliberately scoped token over a global account key.
Copy the Cloudflare Account ID for the account in which new zones should be created. A Zone ID identifies one zone and must not be pasted into the Account ID field. Record any expiration or source-network restriction so scheduled workers remain authorised.
01 Connect Domain Nexus
- Open Servers, add a connection and select Cloudflare.
- Paste the token into API Token. Enter the matching Account ID when provisioning new zones into that account.
- Save and run the connection check. Read its detail: when no zone is available to inspect, authentication alone cannot prove record access.
- Use an authorised zone for a temporary TXT record test, then read it back from Cloudflare after the task finishes.
- Assign the connection to the intended DNS package only after the planned reads, writes and provisioning operations are verified.
02 Check delegation and provider-specific settings
A newly created Cloudflare zone can remain pending until the registrar uses the nameservers assigned to that exact zone. Do not copy another zone's pair. Confirm the actual delegation before telling a customer that DNS is live.
Review proxy settings separately from record content. Cloudflare's proxy and other zone features are not equivalent to ordinary portable DNS records. When using the connection as a replication target, inspect the module's handling of existing records and supported metadata before a bulk change. If DNSSEC is enabled, coordinate the parent DS with the registrar and verify the chain instead of relying only on the dashboard switch.
Related articles
- Preserve Cloudflare proxy settings when synchronising DNS records
- Operate DNSSEC from zone signing through parent DS verification
- Synchronize a DNS package across multiple servers and select its master
- Run a controlled DNS provider acceptance check before assigning customer packages
- Connect Gandi LiveDNS with an organisation-scoped personal access token