GoAdmio
GoAdmio Documentation

Cloudflare API

From the GoAdmio knowledge base.

Cloudflare API

This page explains the Cloudflare API integration in GoAdmio. It connects GoAdmio to your Cloudflare account so the panel can automatically manage DNS zones, cache rules, bot management, and other Cloudflare features for domains on the server.

Location: Admin Panel → Domain API → Cloudflare API


Overview

Cloudflare is a CDN, DNS, and security provider that sits in front of your websites. When a domain uses Cloudflare, its DNS is managed at Cloudflare — not on the GoAdmio server. GoAdmio's Cloudflare API integration lets the panel talk directly to Cloudflare so it can:

  • Create and manage DNS zones — automatically add domains and records
  • Configure DMARC — add and update DMARC records
  • Manage cache rules — set up caching behavior
  • Configure bot management — control bot protection
  • Purge cache — clear Cloudflare's cached content
  • Manage page rules — configure redirects and rules
  • Edit DNS records — A, AAAA, CNAME, MX, TXT, and others
This integration is required for features that auto-configure DNS, such as Forward Email API, and for the /go/dns command that creates all required records for a domain in one operation.

> Note: The Cloudflare API integration requires a Cloudflare account and an API token with specific permissions. Without it, GoAdmio cannot manage DNS or cache for Cloudflare-hosted domains — you would have to make all changes manually in the Cloudflare dashboard.


What the Page Shows

| Field | Description |
|---|---|
| Account ID | Your Cloudflare account ID (found in the Cloudflare dashboard) |
| API Token | The API token GoAdmio uses to authenticate |
| Required Cloudflare API Permissions | The exact permissions the token must have |
| Save / Verify | Apply and test the credentials |

Required Permissions

The page lists the exact permissions the API token must have:

| Zone | Permission | Access |
|---|---|---|
| DMARC Management | Edit | Create and update DMARC records |
| Cache Rules | Edit | Configure caching behavior |
| Bot Management | Edit | Control bot protection |
| Zone | Edit | Manage zone settings |
| Cache Purge | Purge | Clear cached content |
| Page Rules | Edit | Configure redirects and rules |
| DNS | Edit | Create and update DNS records |

> Warning: The API token must have exactly these permissions. A token with too few permissions causes API calls to fail; a token with too many is an unnecessary security risk. Follow the principle of least privilege.


Prerequisites

Before configuring Cloudflare API:

  1. A Cloudflare account — https://dash.cloudflare.com
  2. At least one domain added to Cloudflare — with nameservers pointed at Cloudflare
  3. The domain's nameservers at the registrar — must point to Cloudflare's nameservers (see Nameservers)
  4. Your Cloudflare Account ID — found in the Cloudflare dashboard
  5. An API token with the exact permissions listed above
  6. Root access to the GoAdmio Admin Panel
> Tip: If a domain's nameservers do not point to Cloudflare, Cloudflare is not authoritative for that domain — the API cannot manage its DNS. The customer must first switch nameservers at the registrar.

How to Get Your Cloudflare Account ID

  1. Log in to Cloudflare — https://dash.cloudflare.com
  2. Click Workers & Pages (or Account Home) in the sidebar.
  3. The Account ID is shown on the right side of the overview page.
  4. Copy it — you will paste it into the Account ID field in GoAdmio.
> Tip: The Account ID is a 32-character hex string (e.g., 205e721b935c28fc79b87ff41a9c7722). It is not secret — but it is required for the API to work.

How to Create an API Token

Step 1 — Open the API tokens page

  1. Log in to Cloudflare.
  2. Click My Profile (top-right avatar) → API Tokens.
  3. Click Create Token.

Step 2 — Choose a template or custom token

  1. Scroll to Custom token and click Get started.
  2. Name the token (e.g., GoAdmio).

Step 3 — Configure the permissions

Add each of the required permissions:

| Type | Resource | Permission |
|---|---|---|
| Zone | DMARC Management | Edit |
| Zone | Cache Rules | Edit |
| Zone | Bot Management | Edit |
| Zone | Zone | Edit |
| Zone | Cache Purge | Purge |
| Zone | Page Rules | Edit |
| Zone | DNS | Edit |

Under Zone Resources, choose:

  • Include → All zones (if GoAdmio manages all your Cloudflare zones), or
  • Include → Specific zone → select the zones GoAdmio should manage
> Tip: If you host many domains on the server but only some are on Cloudflare, restrict the token to the specific zones GoAdmio manages. A token scoped to All zones has broader reach — use it only when all your zones are managed by GoAdmio.

Step 4 — Create and copy the token

  1. Click Continue to summary.
  2. Review the permissions.
  3. Click Create Token.
  4. Copy the token immediately — it is shown only once.
> Warning: The API token is a secret. Store it in a password manager. Do not commit it to source control, paste it into public chats, or share it with customers. If it is exposed, revoke it immediately in Cloudflare and create a new one.

How to Configure the Integration

  1. Log in to the GoAdmio Admin Panel.
  2. Navigate to Domain API → Cloudflare API.
  3. Paste your Account ID.
  4. Paste your API Token.
  5. Click Save (or Verify).
GoAdmio validates the credentials by making a test call to Cloudflare. If the credentials are valid and the permissions are correct, the integration is active.

> Tip: If verification fails, check the error message — it usually indicates a missing permission or an invalid token.


What the Integration Enables

Once configured, GoAdmio can use the Cloudflare API for:

| Feature | GoAdmio page / command |
|---|---|
| Add a domain to Cloudflare | /go/dns domain.com |
| Create all DNS records (A, AAAA, MX, SPF, DKIM, DMARC, autodiscover, autoconfig) | /go/dns domain.com |
| Add all domains | /go/dns all |
| Edge cache TTL | /go/dns all --cache |
| Update A records only | /go/dns all --quick |
| Configure ForwardEmail relay | /go/forwardemail domain.com |
| Manage DNS records | /go/cloudflare |
| Purge cache | Via the panel's cache page |
| Manage Cloudflare Proxy | See Cloudflare Proxy |

> Tip: /go/dns domain.com is the most powerful command — it adds the domain to Cloudflare, creates every record needed for web and email, and can switch nameservers automatically for supported registrars. See Command Reference.


Security Best Practices

| Practice | Why |
|---|---|
| Treat the token like a password | Anyone with the token can manage your Cloudflare account |
| Use exactly the required permissions | Least privilege reduces risk |
| Scope the token to specific zones | Limits the blast radius if leaked |
| Rotate the token periodically | Limits the window of exposure |
| Revoke tokens that are no longer used | Reduces attack surface |
| Do not commit the token to source control | Prevents accidental leakage |
| Do not paste the token into public chats | It is a secret |
| Monitor Cloudflare's audit log | Detect unexpected API activity |
| Use one token per integration | Revoke one without affecting others |
| Keep the Account ID handy but treat it as semi-public | It is not a secret, but it should not be published |

> Warning: The API token shown on the page is sensitive. If the GoAdmio panel is accessible to non-admin users, restrict access to the Cloudflare API page in your permissions. A leaked token can let an attacker modify DNS, redirect traffic, or purge caches across your Cloudflare account.


Verifying the Integration

From the panel

After saving, the panel usually shows a Verified status or a success message.

From the shell

Test the API credentials directly with curl:

```bash

Test the token (list zones)


curl -X GET "https://api.cloudflare.com/client/v4/zones" \
-H "Authorization: Bearer <API_TOKEN>" \
-H "Content-Type: application/json"

A successful response includes "success": true and the list of zones

↑