Skip to content

Commit db267de

Browse files
StringKeclaude
StringKe
and
claude
committed
docs: update API token configuration documentation
- Add quick create script using Cloudflare API - Update permission matrix with correct permission names - Add per-CRD permission requirements - Fix Access Groups/Identity Providers permission (Organizations, not Apps) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
1 parent 5296b45 commit db267de

2 files changed

Lines changed: 106 additions & 18 deletions

File tree

‎docs/en/configuration.md‎

Lines changed: 53 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,29 +4,73 @@ This guide covers API token configuration and credential management.
44

55
## API Token Setup
66

7-
### Creating an API Token
7+
### Quick Create (Recommended)
88

9-
1. Go to [Cloudflare Dashboard](https://dash.cloudflare.com/profile/api-tokens)
9+
Use the script to create a pre-configured API token:
10+
11+
```bash
12+
# Set your credentials
13+
export CF_API_TOKEN="your-existing-token-with-token-create-permission"
14+
export CF_ACCOUNT_ID="your-account-id"
15+
16+
# Create token with all required permissions
17+
curl -X POST "https://api.cloudflare.com/client/v4/user/tokens" \
18+
-H "Authorization: Bearer $CF_API_TOKEN" \
19+
-H "Content-Type: application/json" \
20+
--data '{
21+
"name": "cloudflare-operator",
22+
"policies": [
23+
{
24+
"effect": "allow",
25+
"resources": {"com.cloudflare.api.account.'$CF_ACCOUNT_ID'": "*"},
26+
"permission_groups": [
27+
{"id": "TUNNEL_EDIT_ID", "name": "Cloudflare Tunnel Edit"},
28+
{"id": "ACCESS_APPS_EDIT_ID", "name": "Access: Apps and Policies Edit"},
29+
{"id": "ACCESS_ORGS_EDIT_ID", "name": "Access: Organizations, Identity Providers, and Groups Edit"},
30+
{"id": "ACCESS_TOKENS_EDIT_ID", "name": "Access: Service Tokens Edit"},
31+
{"id": "ZERO_TRUST_EDIT_ID", "name": "Zero Trust Edit"}
32+
]
33+
},
34+
{
35+
"effect": "allow",
36+
"resources": {"com.cloudflare.api.account.zone.*": "*"},
37+
"permission_groups": [
38+
{"id": "DNS_EDIT_ID", "name": "DNS Edit"}
39+
]
40+
}
41+
]
42+
}'
43+
```
44+
45+
> **Note**: Replace `*_ID` placeholders with actual permission group IDs from your account. Get them via: `GET /accounts/{account_id}/iam/permission_groups`
46+
47+
### Manual Create (Dashboard)
48+
49+
1. Go to [Cloudflare Dashboard > API Tokens](https://dash.cloudflare.com/profile/api-tokens)
1050
2. Click **Create Token**
1151
3. Select **Create Custom Token**
12-
4. Configure permissions based on your needs
52+
4. Configure permissions as shown below
1353

1454
### Permission Matrix
1555

1656
| Feature | Permission | Scope |
1757
|---------|------------|-------|
18-
| **Tunnel Management** | `Account:Cloudflare Tunnel:Edit` | Account |
58+
| **Tunnel / ClusterTunnel** | `Account:Cloudflare Tunnel:Edit` | Account |
59+
| **VirtualNetwork** | `Account:Cloudflare Tunnel:Edit` | Account |
60+
| **NetworkRoute** | `Account:Cloudflare Tunnel:Edit` | Account |
61+
| **WARPConnector** | `Account:Cloudflare Tunnel:Edit` | Account |
1962
| **DNS Records** | `Zone:DNS:Edit` | Zone (specific or all) |
63+
| **TunnelBinding** | `Zone:DNS:Edit` + (optional) `Account:Access: Apps and Policies:Edit` | Account + Zone |
64+
| **PrivateService** | `Account:Cloudflare Tunnel:Edit` | Account |
2065
| **Access Applications** | `Account:Access: Apps and Policies:Edit` | Account |
21-
| **Access Groups** | `Account:Access: Apps and Policies:Edit` | Account |
22-
| **Access Identity Providers** | `Account:Access: Apps and Policies:Edit` | Account |
66+
| **Access Groups** | `Account:Access: Organizations, Identity Providers, and Groups:Edit` | Account |
67+
| **Access Identity Providers** | `Account:Access: Organizations, Identity Providers, and Groups:Edit` | Account |
2368
| **Access Service Tokens** | `Account:Access: Service Tokens:Edit` | Account |
69+
| **Device Posture Rules** | `Account:Access: Device Posture:Edit` | Account |
70+
| **Device Settings Policy** | `Account:Zero Trust:Edit` | Account |
2471
| **Gateway Rules** | `Account:Zero Trust:Edit` | Account |
2572
| **Gateway Lists** | `Account:Zero Trust:Edit` | Account |
2673
| **Gateway Configuration** | `Account:Zero Trust:Edit` | Account |
27-
| **Device Settings** | `Account:Zero Trust:Edit` | Account |
28-
| **Device Posture** | `Account:Zero Trust:Edit` | Account |
29-
| **WARP Connector** | `Account:Cloudflare Tunnel:Edit` | Account |
3074

3175
### Recommended Token Configurations
3276

‎docs/zh/configuration.md‎

Lines changed: 53 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,29 +4,73 @@
44

55
## API Token 设置
66

7-
### 创建 API Token
7+
### 快速创建（推荐）
88

9-
1. 访问 [Cloudflare 控制台](https://dash.cloudflare.com/profile/api-tokens)
9+
使用脚本创建预配置的 API Token：
10+
11+
```bash
12+
# 设置凭证
13+
export CF_API_TOKEN="你的已有token（需要有创建token的权限）"
14+
export CF_ACCOUNT_ID="你的账户ID"
15+
16+
# 创建包含所有必需权限的 token
17+
curl -X POST "https://api.cloudflare.com/client/v4/user/tokens" \
18+
-H "Authorization: Bearer $CF_API_TOKEN" \
19+
-H "Content-Type: application/json" \
20+
--data '{
21+
"name": "cloudflare-operator",
22+
"policies": [
23+
{
24+
"effect": "allow",
25+
"resources": {"com.cloudflare.api.account.'$CF_ACCOUNT_ID'": "*"},
26+
"permission_groups": [
27+
{"id": "TUNNEL_EDIT_ID", "name": "Cloudflare Tunnel Edit"},
28+
{"id": "ACCESS_APPS_EDIT_ID", "name": "Access: Apps and Policies Edit"},
29+
{"id": "ACCESS_ORGS_EDIT_ID", "name": "Access: Organizations, Identity Providers, and Groups Edit"},
30+
{"id": "ACCESS_TOKENS_EDIT_ID", "name": "Access: Service Tokens Edit"},
31+
{"id": "ZERO_TRUST_EDIT_ID", "name": "Zero Trust Edit"}
32+
]
33+
},
34+
{
35+
"effect": "allow",
36+
"resources": {"com.cloudflare.api.account.zone.*": "*"},
37+
"permission_groups": [
38+
{"id": "DNS_EDIT_ID", "name": "DNS Edit"}
39+
]
40+
}
41+
]
42+
}'
43+
```
44+
45+
> **注意**：将 `*_ID` 占位符替换为你账户的实际权限组 ID。通过以下 API 获取：`GET /accounts/{account_id}/iam/permission_groups`
46+
47+
### 手动创建（控制台）
48+
49+
1. 访问 [Cloudflare 控制台 > API Tokens](https://dash.cloudflare.com/profile/api-tokens)
1050
2. 点击 **Create Token**
1151
3. 选择 **Create Custom Token**
12-
4. 根据需要配置权限
52+
4. 按下表配置权限
1353

1454
### 权限矩阵
1555

1656
| 功能 | 权限 | 范围 |
1757
|------|------|------|
18-
| **隧道管理** | `Account:Cloudflare Tunnel:Edit` | Account |
58+
| **Tunnel / ClusterTunnel** | `Account:Cloudflare Tunnel:Edit` | Account |
59+
| **VirtualNetwork** | `Account:Cloudflare Tunnel:Edit` | Account |
60+
| **NetworkRoute** | `Account:Cloudflare Tunnel:Edit` | Account |
61+
| **WARPConnector** | `Account:Cloudflare Tunnel:Edit` | Account |
1962
| **DNS 记录** | `Zone:DNS:Edit` | Zone（指定或全部）|
63+
| **TunnelBinding** | `Zone:DNS:Edit` + (可选) `Account:Access: Apps and Policies:Edit` | Account + Zone |
64+
| **PrivateService** | `Account:Cloudflare Tunnel:Edit` | Account |
2065
| **Access 应用** | `Account:Access: Apps and Policies:Edit` | Account |
21-
| **Access 组** | `Account:Access: Apps and Policies:Edit` | Account |
22-
| **Access 身份提供商** | `Account:Access: Apps and Policies:Edit` | Account |
66+
| **Access 组** | `Account:Access: Organizations, Identity Providers, and Groups:Edit` | Account |
67+
| **Access 身份提供商** | `Account:Access: Organizations, Identity Providers, and Groups:Edit` | Account |
2368
| **Access 服务令牌** | `Account:Access: Service Tokens:Edit` | Account |
69+
| **设备态势规则** | `Account:Access: Device Posture:Edit` | Account |
70+
| **设备设置策略** | `Account:Zero Trust:Edit` | Account |
2471
| **网关规则** | `Account:Zero Trust:Edit` | Account |
2572
| **网关列表** | `Account:Zero Trust:Edit` | Account |
2673
| **网关配置** | `Account:Zero Trust:Edit` | Account |
27-
| **设备设置** | `Account:Zero Trust:Edit` | Account |
28-
| **设备态势** | `Account:Zero Trust:Edit` | Account |
29-
| **WARP Connector** | `Account:Cloudflare Tunnel:Edit` | Account |
3074

3175
### 推荐的 Token 配置
3276

0 commit comments

Comments
 (0)