Integrations and automation
Cloudflare's REST API (and the newer GraphQL Analytics API for metrics) covers essentially every dashboard action -- DNS record changes, firewall rule updates, cache purges -- which is what most CI/CD and infrastructure-as-code integrations (like the official Terraform provider) actually call under the hood rather than a separate automation layer.
Practical Details
API Tokens (scoped, expiring credentials) are the recommended way to authenticate automation, replacing the legacy Global API Key that grants full account access -- using a scoped token limits blast radius if a CI secret leaks. Cloudflare also supports webhooks for notifications (like a new WAF event or a certificate status change) that can trigger downstream automation.
Actionable Considerations
- Use the official Terraform provider or direct API calls with scoped API Tokens for infrastructure-as-code, rather than manual dashboard changes for repeatable config.
- Replace any Global API Key used in automation with a scoped, expiring API Token to limit blast radius on leak.
- Set up webhook notifications for events like certificate changes or WAF triggers that need downstream automation.