> ## Documentation Index
> Fetch the complete documentation index at: https://docs.maski.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare

> Create a Cloudflare API token scoped to one zone, so Maski can publish your custom-domain records.

Cloudflare supports both ways of authorizing. You can click **Connect with
Cloudflare** in the dashboard and approve Maski on Cloudflare's consent screen, or
mint an API token yourself and paste it. This page covers the token.

<Info>
  Maski needs two permissions on the one zone you are setting up: **Zone:Read**, to
  find the zone, and **DNS:Edit**, to publish the records. Nothing else, and no other
  zone.
</Info>

## Create the token

<Steps>
  <Step title="Open your API tokens">
    Go to [dash.cloudflare.com/profile/api-tokens](https://dash.cloudflare.com/profile/api-tokens),
    or from the dashboard select **My Profile**, then **API Tokens**. Choose
    **Create Token**.
  </Step>

  <Step title="Start a custom token">
    Cloudflare offers templates first. Scroll past them to **Create Custom Token**
    and choose **Get started**. The templates do not match what Maski needs closely
    enough, so build the token yourself.
  </Step>

  <Step title="Set the permissions and the zone">
    Name the token something you will recognise later, for example
    `Maski DNS setup`.

    Under **Permissions**, add two rows. Each row is three dropdowns.

    | Group | Resource | Level |
    | ----- | -------- | ----- |
    | Zone  | DNS      | Edit  |
    | Zone  | Zone     | Read  |

    Under **Zone Resources**, choose **Include**, then **Specific zone**, then the
    domain you are setting up. This is the part that matters most. A token scoped
    to one zone cannot touch anything else in your Cloudflare account.

    Client IP filtering and TTL are optional. Since the token is used once, setting
    a short expiry is a reasonable extra precaution.
  </Step>

  <Step title="Copy the token">
    Choose **Continue to summary**, check the summary reads as expected, then
    **Create Token**. Cloudflare shows the token value once and will not show it
    again. Copy it.
  </Step>

  <Step title="Paste it into Maski">
    Open your domain in the Maski dashboard. In **Set up automatically**, pick
    Cloudflare, choose **Prefer to paste an API token instead?**, paste the token,
    and press **Review changes**.

    Maski reads your zone and shows you what it would change. Nothing is written
    until you press **Publish records**.
  </Step>
</Steps>

## Afterwards

Delete the token at
[dash.cloudflare.com/profile/api-tokens](https://dash.cloudflare.com/profile/api-tokens)
once your domain is set up. Maski does not keep it and will not need it again.

## If it does not work

**"Your DNS provider rejected the request."** The token is missing a permission or
is scoped to a different zone. Check that both **Zone:Read** and **DNS:Edit** are
present and that **Zone Resources** includes this exact domain.

**Maski cannot find the zone.** The domain has to be in the same Cloudflare account
the token belongs to, and Cloudflare has to be authoritative for it. If the domain
sits in a different account, mint the token from that account.

**Cloudflare warns that TXT content will be quoted.** That notice is expected and
harmless. Maski sends unquoted values and normalizes the quotes when it reads them
back, so republishing does not churn.

If none of that helps, add the records by hand from the checklist on the domain
page. A manually configured domain works exactly the same.