Getting Started
Cloudflare Manager uses a Cloudflare API Token to manage domains, DNS records, SSL/TLS settings, cache policies, and site activity data on mobile.
1. Create an API Token
Create a dedicated Cloudflare API Token for mobile management, and grant only the minimum permissions required for the domains you want to manage.
Go to https://dash.cloudflare.com/profile/api-tokens to create your token.
Recommended capability scope:
Permissions
| Type | Permission | Access |
|---|---|---|
| Account | Workers R2 SQL | Read |
| Account | Workers R2 Data Catalog | Edit |
| Account | Workers R2 Storage | Edit |
| Account | Account Analytics | Read |
| Account | Account Settings | Read |
| User | Membership | Read |
| User | User Details | Read |
| Zone | Zone | Edit |
| Zone | DNS | Edit |
| Zone | Analytics | Read |
| Zone | Zone Settings | Edit |
| Zone | SSL and Certificates | Read |
SSL/TLS page permission details:
| Feature | Required permission | Notes |
|---|---|---|
| SSL/TLS encryption mode | Zone Settings · Edit | View and update ssl (Off / Flexible / Full / Full strict) |
| Minimum TLS version | Zone Settings · Edit | View and update min_tls_version |
| Always Use HTTPS | Zone Settings · Edit | View and update always_use_https |
| Automatic HTTPS Rewrites | Zone Settings · Edit | View and update automatic_https_rewrites |
| TLS 1.3 | Zone Settings · Edit | View and update tls_1_3 |
| Opportunistic Encryption | Zone Settings · Edit | View and update opportunistic_encryption |
| HTTP Strict Transport Security (HSTS) | Zone Settings · Edit | View and update security_header (status, max age, include subdomains, preload, no-sniff header) |
| Certificate packs | SSL and Certificates · Read | View Universal / Advanced / Custom certificate packs |
If a permission is missing, that feature is grayed out with “No permission” and does not block other authorized features.
Account resources
| Include | All accounts |
|---|
Zone resources
| Include | All zones |
|---|
Client IP address filtering (optional)
Restrict the token to your own IP address if needed.
Done
Copy the token you receive and paste it into the app on your phone.