Cloudflare changelogs | Cloudflare Fundamentals

Cloudflare Fundamentals - Improved publisher verification details on OAuth consent screens

Wed, 05 Aug 2026 00:00:00 GMT

OAuth consent screens now display a shield icon with explanatory text beneath the consent screen title. Each shield icon indicates who owns the application and whether its domain ownership is verified.

Green filled shield: Cloudflare owns and manages the application.
Blue outlined shield: A third-party application with verified ownership of its domain.
Amber filled shield: A third-party application without verified ownership of a domain.

Domain verification only confirms that the application owner controls the displayed domain.

For more information, refer to Authorizing an application.

Cloudflare Fundamentals - Create Free accounts from the dashboard

Tue, 04 Aug 2026 00:00:00 GMT

You can now create standalone Free accounts directly from the Cloudflare dashboard using the new Create Account button. This feature is currently available to all users.

When creating a Free account:

You can create up to 5 Free accounts.
Your user account must have at least 7 days of tenure to be eligible.
The account is created immediately and ready to use.

To create a Free account, go to the Cloudflare dashboard ↗ and select Create Account from either the account switcher in the top left (where your account name appears) or from the Accounts page.

Limitations

This feature can only be used to create a Cloudflare Free account. To create an Enterprise Account under your existing contract, please contact Cloudflare Support.
All users can create a Cloudflare Free account, however, Enterprises wish to restrict this action to only Super Administrators. We will deliver this improvement in a future release.

Next steps

After creating your Free account, you can:

Add a payment method to enable additional Cloudflare products and services.
Update billing information to manage payment methods, billing address, or tax IDs.
Review how Cloudflare billing works to understand the billing lifecycle and charge types.
Assign accounts to an Enterprise Organization to centrally manage multiple accounts from a single dashboard.

Cloudflare Fundamentals - Account Role API deprecated

Tue, 21 Jul 2026 00:00:00 GMT

The Account Roles API is deprecated and is being replaced by the Permission Groups API. An end of life date has not yet been established.

What you need to do

Review the Permission Groups API documentation; the response schema differs from the legacy Roles response.

Highlights

Integrations migrating to the Permission Groups API must obtain Permission Group IDs from that API and use them in the Account Members API policies request shape. Integrations that persist legacy Role IDs will need to remap their assignments.
The legacy Role response includes a top-level description and a permissions object keyed by resource type with edit/read flags.
The PermissionGroup response replaces those with a meta object containing label and scopes. Individual permissions are not returned as part of the permission group.
The new API supports the API Token authorization scheme. The legacy Email + API Key authorization schema is provided for backwards compatibility.

For more information, refer to API deprecations.

Cloudflare Fundamentals, Organizations - Distributor, MSSP, and Agency partners can manage Organization members directly

Fri, 17 Jul 2026 00:00:00 GMT

Distributor, MSSP, and Agency partners on Cloudflare Organizations can now add and manage Organization Members directly from the Cloudflare dashboard, without help from Cloudflare.

Previously, adding a member to a Distributor, MSSP, or Agency Organization was a manual, Cloudflare-assisted process that required a request to Cloudflare and enrollment in a closed beta, and the dashboard Add member flow was blocked for these Organizations.

Now, Organization admins can add members themselves from Organization > Members > Add member, with no beta enrollment required.

New members receive access to the Organization's accounts through the same implicit-access model already used for enterprise Organizations. The Accounts list and the account switcher classify Distributor, MSSP, and Agency Organizations consistently with enterprise Organizations, so their accounts are labeled and grouped correctly in the dashboard.

Agency partners also gain access to the Organizations dashboard, while retaining access to their existing Tenant management dashboard.

Distributor, MSSP, and Agency Organizations are currently in beta.

For more information, refer to Manage Organization members.

Cloudflare Fundamentals - Origin Content Signals for Markdown for Agents

Mon, 13 Jul 2026 00:00:00 GMT

Markdown for Agents now preserves security- and cache-relevant response headers from your origin when converting HTML to Markdown:

Markdown for Agents preserves security headers such as Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, Set-Cookie, and CORS headers (for example, Access-Control-Allow-Origin) on the converted response.
Caching headers (Cache-Control, Expires, Age) continue to pass through.

Your origin's Content Signals ↗ policy is now authoritative. If your origin sets a content-signal header, Markdown for Agents preserves it. When the origin does not send one, Cloudflare adds the default Content-Signal: ai-train=yes, search=yes, ai-input=yes.

This release also fixes relative link resolution for directory-style base URLs (those ending in a trailing slash). Previously, relative links such as ../page/ could resolve one path segment too high and return a 404. Links are now resolved correctly per RFC 3986 ↗.

Refer to our developer documentation for more details.

Gateway, Cloudflare One, Cloudflare Fundamentals - New permissions and roles for Gateway policies and lists

Tue, 30 Jun 2026 00:00:00 GMT

You can now assign granular, resource-scoped roles for Cloudflare Gateway firewall policies and Zero Trust lists. Administrators can delegate access to specific policy types or list management without granting account-wide or product-wide control.

What is new

When you add a member or create a permission policy, the following resource-scoped roles are now available:

Role	Description
Zero Trust Gateway Firewall Policies Admin	Can view and edit all Gateway firewall policies, including DNS, HTTP, and Network policies.
Zero Trust Gateway DNS Policies Admin	Can view and edit Gateway DNS policies.
Zero Trust Gateway HTTP Policies Admin	Can view and edit Gateway HTTP policies.
Zero Trust Gateway Network Policies Admin	Can view and edit Gateway Network policies.
Zero Trust Gateway Egress Policies Admin	Can view and edit Gateway Egress policies.
Zero Trust Gateway Resolver Policies Admin	Can view and edit Gateway Resolver policies.
Zero Trust Gateway Policies Admin	Can view and edit all Gateway policies.
Zero Trust Gateway Policies Read	Can view all Gateway policies.
Zero Trust Gateway Read Only	Can view all Gateway resources.
Zero Trust DNS Locations Admin	Can view and edit DNS locations.
Zero Trust Proxy Endpoints Admin	Can view and edit Gateway Proxy Endpoints.
Zero Trust Account Lists Admin	Can view and edit all Gateway and Access lists.
Zero Trust Account Lists Read	Can view all Gateway and Access lists.

These roles allow you to:

Grant a network engineer write access to Network policies only, without exposing DNS or HTTP policy configuration.
Allow a security analyst to view all Gateway policies in read-only mode for auditing purposes.
Delegate list management to a team that maintains block and allow lists without giving them access to policy configuration.

You can also now assign Resource-scoped roles. These roles are complementary to existing account-level roles, and allow you to grant access to a specific resource, like an individual Gateway policy or Cloudflare One list. Existing account-level roles continue to work. A member with the Cloudflare Gateway or Cloudflare Zero Trust role retains full access to all Gateway resources. This ensures backward compatibility for existing automation and API tokens.

Get started

Review the resource-scoped roles on the Cloudflare role reference.
Learn how to create permission policies that use these roles.

Cloudflare Fundamentals - Search API tokens by name

Thu, 25 Jun 2026 00:00:00 GMT

You can now search API tokens by name, making it easier to find specific tokens across large token lists without manually paginating.

What's new

Dashboard search: Both account API tokens ↗ and user API tokens ↗ pages now include a search bar. Type a name to filter results.
API search support: The /user/tokens and /accounts/{account_id}/tokens endpoints now accept a name query parameter to filter tokens by name.

For more information, refer to Create an API token and Account API tokens.

Cloudflare Fundamentals, Workers, D1, R2, KV, Queues, Vectorize, Durable Objects, Containers - Billable usage and budget alerts now in product sidebars

Thu, 04 Jun 2026 00:00:00 GMT

Pay-as-you-go customers can now view billable usage and create budget alerts directly from the product overview pages for Workers & Pages, D1, R2, Workers KV, Queues, Vectorize, Durable Objects, and Containers. A new sidebar widget shows current-period spend and the billing cycle date range, alongside a button to create a budget alert.

The widget pulls from the same data as the Billable Usage dashboard and aligns to your billing cycle (or the current day on Free plans), so the numbers match your invoice. Enterprise contract accounts are not yet supported.

Selecting Create budget alert opens the budget alert flow inline so you can set a dollar threshold in the same place you are reviewing usage. Budget alerts apply to your total account-level spend across all products, not just the product page you create them from.

For more information, refer to the Usage-based billing documentation.

Cloudflare Fundamentals - Introducing self-managed OAuth clients

Wed, 03 Jun 2026 00:00:00 GMT

Today we are launching self-managed OAuth, enabling developers to build third-party applications that integrate with Cloudflare via OAuth. This provides a more secure, user-friendly, and manageable alternative to API tokens.

OAuth lets third-party applications act on behalf of a user to access their Cloudflare account. For example, after a user grants consent, Wrangler can deploy Workers into that account.

What is new

Cloudflare Developers can now create and manage their own OAuth applications to integrate with Cloudflare.

Create an application

To create an application, go to Manage account > OAuth clients in your account on the Cloudflare dashboard.

Go to OAuth clients ↗

Select limited scopes

If you have used an API token to call Cloudflare APIs, OAuth client scopes will look familiar. Select only the scopes your application needs during application creation, and include that scope list when sending users to Cloudflare for consent.

Users can review the requested scopes before they consent.

Apps for both private and public use

Applications start with private visibility. Private applications can only be used by members of the account where the application was created.

To make an application available to any Cloudflare user, complete the prerequisites for public visibility.

For more information, refer to client visibility.

Client domain verification

Before an application can be made public, you must verify the client domain. Domain verification helps users confirm that the application owner controls the domain shown on the consent page.

After verification, users see a verified badge on the consent page.

For more information, refer to domain verification.

Learn more

For more information, refer to OAuth clients.

Cloudflare Fundamentals, Cloudflare One, Cloudflare Tunnel for SASE, Cloudflare Tunnel, Cloudflare Mesh - Granular permissions for Cloudflare Tunnel and Cloudflare Mesh

Thu, 21 May 2026 00:00:00 GMT

You can now scope Cloudflare permissions to individual Cloudflare Tunnel instances and Cloudflare Mesh nodes. Administrators can delegate access to specific Tunnels or Mesh nodes without granting account-wide control over private networking.

What is new

When you add a member or create a permission policy, the resource picker now lists Cloudflare Tunnel instances and Cloudflare Mesh nodes as scopable resource types. You can:

Grant a read-only role on a single Cloudflare Tunnel instance to a support operator for log streaming and diagnostics — without exposing other Tunnels or destructive actions.
Grant a write role on a specific Cloudflare Mesh node to an application team — without giving them access to the rest of your private network.
Scope a single policy to one or many Tunnels and Mesh nodes at once.

How it works

Granular permissions are a parallel layer to existing account-level roles — they do not replace them.

Existing account-level roles continue to work. A member with Cloudflare Access or Cloudflare Zero Trust retains write access to every Tunnel and Mesh node in the account. This ensures backward compatibility for existing automation and tokens.
Granular permissions are additive. For any API request on a specific Tunnel or Mesh node, access is granted if the principal has either the account-level role or a granular permission for that resource.
Resource enumeration is authorization-aware. Listing endpoints (GET /accounts/{id}/cfd_tunnel, GET /accounts/{id}/warp_connector) return only the resources the principal has at least read access to.

Get started

Configure granular permissions for Cloudflare Tunnel.
Configure granular permissions for Cloudflare Tunnel and Cloudflare Mesh in Cloudflare One.
Review the resource-scoped roles on the Cloudflare role reference.

Cloudflare Fundamentals - Keyboard shortcuts for the Cloudflare dashboard

Mon, 04 May 2026 00:00:00 GMT

You can now navigate, switch context, and take common actions in the Cloudflare dashboard without leaving your keyboard. Press ? anywhere to see the full list. Keyboard shortcuts can be disabled by visiting your profile settings ↗.

Navigate

Shortcut	Action
`g h`	Go to Home
`g a`	Go to account overview
`g z`	Go to zone overview
`g p`	Go to your profile
`g w`	Go to Workers & Pages
`g o`	Go to Zero Trust
`g b`	Go to billing
`g 1` – `g 5`	Go to a recent or pinned item (by position in sidebar)
`t →`	Move to the next tab
`t ←`	Move to the previous tab
`p →`	Move to the next page of a table
`p ←`	Move to the previous page of a table

Take action

Shortcut	Action
`/`	Open quick search
`?`	Show keyboard shortcuts
`s a`	Switch account
`s z`	Switch zone
`s .`	Star or unstar the current zone
`p .`	Pin or unpin the current page
`t s`	Toggle the sidebar open or closed
`t m`	Expand or collapse all sidebar menus
`t a`	Toggle Ask AI sidebar
`d .`	Toggle dark mode
`c u`	Copy the current URL
`c d`	Copy a deep link URL

Cloudflare Fundamentals - Instant Bank Payments via Link

Wed, 29 Apr 2026 00:00:00 GMT

You can now pay for Cloudflare services directly from your bank account using Instant Bank Payments via Link.

What changed

Link ↗ now supports bank account payments in addition to cards. If you have a bank account saved in Link, it appears as a payment option at checkout. If not, you can connect one during the checkout flow.

How to use it

During checkout, select your bank account from your saved Link payment methods.
Confirm the payment.

After your first Link authentication, your bank account is available for future purchases without re-entering details.

Who is eligible

Instant Bank Payments via Link is available to US-based self-serve accounts across all Cloudflare products. Your existing cards remain available at checkout.

Bank-based Link payments appear in your billing history with the payment method shown as link and last four digits as 0000. For details, refer to the Instant Bank Payments via Link documentation.

Cloudflare Fundamentals - Structured error responses for Cloudflare 5xx errors

Mon, 27 Apr 2026 00:00:00 GMT

Cloudflare-generated 5xx error responses now return structured JSON and Markdown when agents request them, matching the format already available for 1xxx errors. Responses follow RFC 9457 (Problem Details for HTTP APIs) ↗ and include a Retry-After HTTP header on retryable codes.

Changes

5xx coverage. Ten Cloudflare-generated error codes (500, 502, 504, 520-526) now serve structured responses. These are errors Cloudflare itself generates when it cannot reach or understand the origin server. Origin-generated 5xx responses that Cloudflare passes through are not affected.

Fault attribution. The error_category field tells agents where the fault lies:

origin (502, 504, 520-524) — the origin server is responsible. Transient; retry with the backoff in retry_after.
cloudflare (500) — Cloudflare's fault, not the website or the request. Short retry.
ssl (525, 526) — the origin's TLS configuration is broken. Do not retry.

Retry-After header. Retryable codes (500, 502, 504, 520-524) include a Retry-After HTTP header matching the retry_after body field. Non-retryable codes (525, 526) do not include the header.

Negotiation behavior

Request header sent	Response format
`Accept: application/json`	JSON (`application/json` content type)
`Accept: application/problem+json`	JSON (`application/problem+json` content type)
`Accept: application/json, text/markdown;q=0.9`	JSON
`Accept: text/markdown`	Markdown
`Accept: text/markdown, application/json`	Markdown (equal `q`, first-listed wins)
`Accept: /`	HTML (default)

Availability

Available now for all zones on all plans.

Get started

Get JSON response for error 522:

curl -s --compressed -H "Accept: application/json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "<YOUR_DOMAIN>/cdn-cgi/error/522" | jq .

Check presence of the Retry-After HTTP header associated with the JSON response for error 521:

curl -s --compressed -D - -o /dev/null -H "Accept: application/json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "<YOUR_DOMAIN>/cdn-cgi/error/521" | grep -i retry-after

References:

Cloudflare Fundamentals, Resource Tagging - Resource Tagging enters public beta

Mon, 27 Apr 2026 00:00:00 GMT

Resource Tagging is now in public beta and rolling out to all Cloudflare accounts over the coming days. You can attach custom key-value metadata to your Cloudflare resources and query across your entire account to find what you need.

What's included

Broad resource type support — Tag zones, custom hostnames, Cloudflare Tunnels, Workers, D1 databases, R2 buckets, KV namespaces, Durable Object namespaces, Queues, Stream videos, Images, Access applications, Gateway rules, AI Gateways, and more. Refer to the full list of supported resource types.
Powerful filtering — Query tagged resources using AND/OR logic, negation, and key-only matching. Combine up to 20 filters per query to build precise resource views.
Account and zone-level endpoints — Full CRUD operations across both scopes.
Token-based authentication — Tagging supports Account Owned Tokens that persist independently of individual users, so your automation keeps running through credential rotations and team changes.
Flexible role support — Super Administrators, Workers Admins, and Tag Admins can all manage tags.

API-first by design

The API is the primary interface for Resource Tagging and the recommended path for all workflows — scripting tag assignments, building CI/CD pipelines, or integrating with your infrastructure-as-code toolchain.

Dashboard UI

You can also view and manage tagged resources directly in the Cloudflare dashboard. Navigate to Manage Account > Resource Tagging to see all tagged resources across your account, filter by resource name or tag, and add or edit tags inline.

What's coming next

In future releases, expect support for additional resource types across the Cloudflare platform, tag-based access control policies for scoping user permissions to tagged resources, billing and usage attribution by tag for breaking down costs by team, project, or environment, and Terraform provider support for managing tags declaratively.

Current limitations

PUT replaces all tags on a resource (no partial update). Use the GET, merge, PUT workflow to modify individual tags safely.
DELETE removes all tags from a resource. To remove a single tag, PUT the remaining tags back.
Querying tags for a resource that has never been tagged returns 500 instead of 404. This is a known beta limitation.

To get started, refer to the Resource Tagging documentation.

Cloudflare Fundamentals - Network Overview page in the dashboard

Tue, 21 Apr 2026 12:00:00 GMT

A new Network Overview page in the Cloudflare dashboard gives you a single starting point for network security and connectivity products.

From the Network Overview page, you can:

Connect resources with Cloudflare Tunnel - Create tunnels to connect your infrastructure to Cloudflare without exposing it to the public Internet.
Monitor traffic with Network Flow - Get real-time visibility into traffic volume from your routers.
Configure Address Maps - Map dedicated static IPs or BYOIP prefixes to specific hostnames.
Explore Magic Transit and Cloudflare WAN - Set up DDoS protection for your networks and connectivity for your branch offices and data centers.

To find it, go to Networking ↗ in the dashboard sidebar.

If you already use Magic Transit, Cloudflare WAN, or other Cloudflare network services products, your existing experience is unchanged.

Cloudflare Fundamentals, Workers - Introducing Billable Usage dashboard and Budget alerts

Tue, 21 Apr 2026 00:00:00 GMT

Pay-as-you-go customers can now monitor usage-based costs and configure spend alerts through two new features: the Billable Usage dashboard and Budget alerts.

Billable Usage dashboard

The Billable Usage dashboard provides daily visibility into usage-based costs across your Cloudflare account. The data comes from the same system that generates your monthly invoice, so the figures match your bill.

The dashboard displays:

A bar chart showing daily usage charges for your billing period
A sortable table breaking down usage by product, including total usage, billable usage, and cumulative costs
Ability to view previous billing periods

Usage data aligns to your billing cycle, not the calendar month. The total usage cost shown at the end of a completed billing period matches the usage overage charges on your corresponding invoice.

To access the dashboard, go to Manage Account > Billing > Billable Usage.

Budget alerts

Budget alerts allow you to set dollar-based thresholds for your account-level usage spend. You receive an email notification when your projected monthly spend reaches your configured threshold, giving you proactive visibility into your bill before month-end.

To configure a budget alert:

Go to Manage Account > Billing > Billable Usage.
Select Set Budget Alert.
Enter a budget threshold amount greater than $0.
Select Create.

Alternatively, configure alerts via Notifications > Add > Budget Alert.

You can create multiple budget alerts at different dollar amounts. The notifications system automatically deduplicates alerts if multiple thresholds trigger at the same time. Budget alerts are calculated daily based on your usage trends and fire once per billing cycle when your projected spend first crosses your threshold.

Both features are available to Pay-as-you-go accounts with usage-based products (Workers, R2, Images, etc.). Enterprise contract accounts are not supported.

For more information, refer to the Usage based billing documentation.

Cloudflare Fundamentals - Improved OAuth experience for consent and management

Tue, 14 Apr 2026 00:00:00 GMT

OAuth allows third-party applications to access your Cloudflare account on your behalf — like when Wrangler deploys Workers or when monitoring tools read your analytics. You now have granular control over which accounts these applications can access, plus the ability to revoke access anytime.

What's new

Choose which accounts to authorize

When authorizing an OAuth application, you can now select specific accounts instead of granting access to all your accounts:

Account-by-account selection — Choose exactly which accounts the application can access
"All accounts" option — Still available for trusted tools like Wrangler This gives you precise control who can access your data.

The OAuth consent screen now shows:

What the application can access — Explicit list of permissions being requested
Who created the application — Application owner and contact information
Which accounts you're authorizing — Checkboxes for account selection

Revoke access anytime

Manage authorized OAuth applications from your profile:

See all connected apps — View every OAuth application with access to your accounts
Review permissions and scope — Check what each application can do and which accounts it can access
Revoke instantly — Remove access with one click when you no longer need it To manage your OAuth applications, navigate to Profile > Access Management > Connected Applications ↗.

Why this matters

These updates give you:

Granular control — Authorize apps per-account instead of all-or-nothing
Transparency — Know exactly what you're authorizing before you consent
Security — Limit blast radius by restricting access to only necessary accounts
Easy cleanup — Revoke access when applications are no longer needed

Learn more

Read more about these improvements in our blog post: Improving the OAuth consent experience ↗.

Cloudflare Fundamentals - API tokens now detectable by secret scanning tools

Fri, 10 Apr 2026 00:00:00 GMT

Cloudflare API tokens now include identifiable patterns that enable secret scanning tools to automatically detect them when leaked in code repositories, configuration files, or other public locations.

What changed

API tokens generated by Cloudflare now follow a standardized format that secret scanning tools can recognize. When a Cloudflare token is accidentally committed to GitHub, GitLab, or another platform with secret scanning enabled, the tool will flag it and alert you.

Why this matters

Leaked credentials are a common security risk. By making Cloudflare tokens detectable by scanning tools, you can:

Detect leaks faster — Get notified immediately when a token is exposed.
Reduce risk window — Exposed tokens are deactivated immediately, before they can be exploited.
Automate security — Leverage existing secret scanning infrastructure without additional configuration.

What happens when a leak is detected

When a third-party secret scanning tool detects a leaked Cloudflare API token:

Cloudflare immediately deactivates the token to prevent unauthorized access.
The token creator receives an email notification alerting them to the leak.
The token is marked as "Exposed" in the Cloudflare dashboard.
You can then roll or delete the token from the token management pages.

Supported platforms

GitHub Secret Scanning — Automatically enabled for public repositories

For more information on token formats and secret scanning, refer to API token formats.

Cloudflare Fundamentals, Cloudflare One, Gateway, Organizations - Organizations is now in public beta for enterprises

Mon, 06 Apr 2026 00:00:00 GMT

We're announcing the public beta of Organizations for enterprise customers, a new top-level Cloudflare container that lets Cloudflare customers manage multiple accounts, members, analytics, and shared policies from one centralized location.

What's New

Organizations [BETA]: Organizations are a new top-level container for centrally managing multiple accounts. Each Organization supports up to 500 accounts and 5000 zones, giving larger teams a single place to administer resources at scale.

Self-serve onboarding: Enterprise customers can create an Organization in the dashboard and assign accounts where they are already Super Administrators.

Centralized Account Management: At launch, every Organization member has the Organization Super Admin role. Organization Super Admins can invite other users and manage any child account under the Organization implicitly. Shared policies: Share WAF or Gateway policies across multiple accounts within your Organization to simplify centralized policy management. Implicit access: Members of an Organization automatically receive Super Administrator permissions across child accounts, removing the need for explicit membership on each account. Additional Org-level roles will be available over the course of the year.

Unified analytics: View, filter, and download aggregate HTTP analytics across all Organization child accounts from a single dashboard for centralized visibility into traffic patterns and security events.

Terraform provider support: Manage Organizations with infrastructure as code from day one. Provision organizations, assign accounts, and configure settings programmatically with the Cloudflare Terraform provider ↗.

Shared policies: Share WAF or Gateway policies across multiple accounts within your Organization to simplify centralized policy management.

For more info:

Cloudflare Fundamentals - Service Key authentication deprecated

Thu, 19 Mar 2026 00:00:00 GMT

Service Key authentication for the Cloudflare API is deprecated. Service Keys will stop working on September 30, 2026.

API Tokens replace Service Keys with fine-grained permissions, expiration, and revocation.

What you need to do

Replace any use of the X-Auth-User-Service-Key header with an API Token scoped to the permissions your integration requires.

If you use cloudflared, update to a version from November 2022 or later. These versions already use API Tokens.

If you use origin-ca-issuer ↗, update to a version that supports API Token authentication.

For more information, refer to API deprecations.

Cloudflare Fundamentals - SCIM provisioning for Authentik is now Generally Available

Wed, 18 Mar 2026 00:00:00 GMT

Cloudflare dashboard SCIM provisioning now supports Authentik ↗ as an identity provider, joining Okta and Microsoft Entra ID as explicitly supported providers.

Customers can now sync users and group information from Authentik to Cloudflare, apply Permission Policies to those groups, and manage the lifecycle of users & groups directly from your Authentik Identity Provider.

For more information:

Cloudflare Fundamentals - SCIM audit logging Support

Wed, 18 Mar 2026 00:00:00 GMT

Cloudflare dashboard SCIM provisioning operations are now captured in Audit Logs v2, giving you visibility into user and group changes made by your identity provider.

Logged actions:

Action Type	Description
Create SCIM User	User provisioned from IdP
Replace SCIM User	User fully replaced (PUT)
Update SCIM User	User attributes modified (PATCH)
Delete SCIM User	Member deprovisioned
Create SCIM Group	Group provisioned from IdP
Update SCIM Group	Group membership or attributes modified
Delete SCIM Group	Group deprovisioned

For more details, refer to the Audit Logs v2 documentation.

Cloudflare Fundamentals - Retry-After HTTP header for retryable 1xxx errors

Thu, 12 Mar 2026 00:00:00 GMT

Cloudflare-generated 1xxx error responses now include a standard Retry-After HTTP header when the error is retryable. Agents and HTTP clients can read the recommended wait time from response headers alone — no body parsing required.

Changes

Seven retryable error codes now emit Retry-After:

Error code	Retry-After (seconds)	Error name
1004	120	DNS resolution error
1005	120	Banned zone
1015	30	Rate limited
1033	120	Argo Tunnel error
1038	60	HTTP headers limit exceeded
1200	60	Cache connection limit
1205	5	Too many redirects

The header value matches the existing retry_after body field in JSON and Markdown responses.

If a WAF rate limiting rule has already set a dynamic Retry-After value on the response, that value takes precedence.

Availability

Available for all zones on all plans.

Verify

Check for the header on any retryable error:

curl -s --compressed -D - -o /dev/null -H "Accept: application/json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "<YOUR_DOMAIN>/cdn-cgi/error/1015" | grep -i retry-after

References:

Cloudflare Fundamentals - JSON responses and RFC 9457 support for Cloudflare 1xxx errors

Wed, 11 Mar 2026 00:00:00 GMT

Cloudflare-generated 1xxx errors now return structured JSON when clients send Accept: application/json or Accept: application/problem+json. JSON responses follow RFC 9457 (Problem Details for HTTP APIs) ↗, so any HTTP client that understands Problem Details can parse the base members without Cloudflare-specific code.

Breaking change

The Markdown frontmatter field http_status has been renamed to status. Agents consuming Markdown frontmatter should update parsers accordingly.

Changes

JSON format. Clients sending Accept: application/json or Accept: application/problem+json now receive a structured JSON object with the same operational fields as Markdown frontmatter, plus RFC 9457 standard members.

RFC 9457 standard members (JSON only):

type — URI pointing to Cloudflare documentation for the specific error code
status — HTTP status code (matching the response status)
title — short, human-readable summary
detail — human-readable explanation specific to this occurrence
instance — Ray ID identifying this specific error occurrence

Field renames:

http_status -> status (JSON and Markdown)
what_happened -> detail (JSON only — Markdown prose sections are unchanged)

Content-Type mirroring. Clients sending Accept: application/problem+json receive Content-Type: application/problem+json; charset=utf-8 back; Accept: application/json receives application/json; charset=utf-8. Same body in both cases.

Negotiation behavior

Request header sent	Response format
`Accept: application/json`	JSON (`application/json` content type)
`Accept: application/problem+json`	JSON (`application/problem+json` content type)
`Accept: application/json, text/markdown;q=0.9`	JSON
`Accept: text/markdown`	Markdown
`Accept: text/markdown, application/json`	Markdown (equal `q`, first-listed wins)
`Accept: /`	HTML (default)

Availability

Available now for Cloudflare-generated 1xxx errors.

Get started

curl -s --compressed -H "Accept: application/json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "<YOUR_DOMAIN>/cdn-cgi/error/1015" | jq .

curl -s --compressed -H "Accept: application/problem+json" -A "TestAgent/1.0" -H "Accept-Encoding: gzip, deflate" "<YOUR_DOMAIN>/cdn-cgi/error/1015" | jq .

References:

Cloudflare Fundamentals - Markdown responses for Cloudflare 1xxx errors

Thu, 26 Feb 2026 00:00:00 GMT

Cloudflare now returns structured Markdown responses for Cloudflare-generated 1xxx errors when clients send Accept: text/markdown.

Each response includes YAML frontmatter plus guidance sections (What happened / What you should do) so agents can make deterministic retry and escalation decisions without parsing HTML.

In measured 1,015 comparisons, Markdown reduced payload size and token footprint by over 98% versus HTML.

Included frontmatter fields:

error_code, error_name, error_category, http_status
ray_id, timestamp, zone
cloudflare_error, retryable, retry_after (when applicable), owner_action_required

Default behavior is unchanged: clients that do not explicitly request Markdown continue to receive HTML error pages.

Negotiation behavior

Cloudflare uses standard HTTP content negotiation on the Accept header.

Accept: text/markdown -> Markdown
Accept: text/markdown, text/html;q=0.9 -> Markdown
Accept: text/* -> Markdown
Accept: */* -> HTML (default browser behavior)

When multiple values are present, Cloudflare selects the highest-priority supported media type using q values. If Markdown is not explicitly preferred, HTML is returned.

Availability

Available now for Cloudflare-generated 1xxx errors.

Get started

curl -H "Accept: text/markdown" https://<your-domain>/cdn-cgi/error/1015

Reference: Cloudflare 1xxx error documentation

Cloudflare Fundamentals - Content encoding support for Markdown for Agents and other improvements

Mon, 16 Feb 2026 00:00:00 GMT

When AI systems request pages from any website that uses Cloudflare and has Markdown for Agents enabled, they can express the preference for text/markdown in the request: our network will automatically and efficiently convert the HTML to markdown, when possible, on the fly.

This release adds the following improvements:

The origin response limit was raised from 1 MB to 2 MB (2,097,152 bytes).
We no longer require the origin to send the content-length header.
We now support content encoded responses from the origin.

If you haven’t enabled automatic Markdown conversion yet, visit the AI Crawl Control ↗ section of the Cloudflare dashboard and enable Markdown for Agents.

Refer to our developer documentation for more details.

Cloudflare Fundamentals, Access - Fine-grained permissions for Access policies and service tokens

Fri, 13 Feb 2026 00:00:00 GMT

Fine-grained permissions for Access policies and Access service tokens are available. These new resource-scoped roles expand the existing RBAC model, enabling administrators to grant permissions scoped to individual resources.

New roles

Cloudflare Access policy admin: Can edit a specific Access policy in an account.
Cloudflare Access service token admin: Can edit a specific Access service token in an account.

These roles complement the existing resource-scoped roles for Access applications, identity providers, and infrastructure targets.

For more information:

Cloudflare Fundamentals, SDK - Cloudflare Python SDK v5.0.0-beta.1 now available

Fri, 13 Feb 2026 00:00:00 GMT

Disclaimer: Please note that v5.0.0-beta.1 is in Beta and we are still testing it for stability.

Full Changelog: v4.3.1...v5.0.0-beta.1 ↗

In this release, you'll see a large number of breaking changes. This is primarily due to a change in OpenAPI definitions, which our libraries are based off of, and codegen updates that we rely on to read those OpenAPI definitions and produce our SDK libraries. As the codegen is always evolving and improving, so are our code bases.

There may be changes that are not captured in this changelog. Feel free to open an issue to report any inaccuracies, and we will make sure it gets into the changelog before the v5.0.0 release.

Most of the breaking changes below are caused by improvements to the accuracy of the base OpenAPI schemas, which sometimes translates to breaking changes in downstream clients that depend on those schemas.

Please ensure you read through the list of changes below and the migration guide before moving to this version - this will help you understand any down or upstream issues it may cause to your environments.

Breaking Changes

The following resources have breaking changes. See the v5 Migration Guide ↗ for detailed migration instructions.

abusereports
acm.totaltls
apigateway.configurations
cloudforceone.threatevents
d1.database
intel.indicatorfeeds
logpush.edge
origintlsclientauth.hostnames
queues.consumers
radar.bgp
rulesets.rules
schemavalidation.schemas
snippets
zerotrust.dlp
zerotrust.networks

Features

New API Resources

abusereports - Abuse report management
abusereports.mitigations - Abuse report mitigation actions
ai.tomarkdown - AI-powered markdown conversion
aigateway.dynamicrouting - AI Gateway dynamic routing configuration
aigateway.providerconfigs - AI Gateway provider configurations
aisearch - AI-powered search functionality
aisearch.instances - AI Search instance management
aisearch.tokens - AI Search authentication tokens
alerting.silences - Alert silence management
brandprotection.logomatches - Brand protection logo match detection
brandprotection.logos - Brand protection logo management
brandprotection.matches - Brand protection match results
brandprotection.queries - Brand protection query management
cloudforceone.binarystorage - CloudForce One binary storage
connectivity.directory - Connectivity directory services
d1.database - D1 database management
diagnostics.endpointhealthchecks - Endpoint health check diagnostics
fraud - Fraud detection and prevention
iam.sso - IAM Single Sign-On configuration
loadbalancers.monitorgroups - Load balancer monitor groups
organizations - Organization management
organizations.organizationprofile - Organization profile settings
origintlsclientauth.hostnamecertificates - Origin TLS client auth hostname certificates
origintlsclientauth.hostnames - Origin TLS client auth hostnames
origintlsclientauth.zonecertificates - Origin TLS client auth zone certificates
pipelines - Data pipeline management
pipelines.sinks - Pipeline sink configurations
pipelines.streams - Pipeline stream configurations
queues.subscriptions - Queue subscription management
r2datacatalog - R2 Data Catalog integration
r2datacatalog.credentials - R2 Data Catalog credentials
r2datacatalog.maintenanceconfigs - R2 Data Catalog maintenance configurations
r2datacatalog.namespaces - R2 Data Catalog namespaces
radar.bots - Radar bot analytics
radar.ct - Radar certificate transparency data
radar.geolocations - Radar geolocation data
realtimekit.activesession - Real-time Kit active session management
realtimekit.analytics - Real-time Kit analytics
realtimekit.apps - Real-time Kit application management
realtimekit.livestreams - Real-time Kit live streaming
realtimekit.meetings - Real-time Kit meeting management
realtimekit.presets - Real-time Kit preset configurations
realtimekit.recordings - Real-time Kit recording management
realtimekit.sessions - Real-time Kit session management
realtimekit.webhooks - Real-time Kit webhook configurations
tokenvalidation.configuration - Token validation configuration
tokenvalidation.rules - Token validation rules
workers.beta - Workers beta features

New Endpoints (Existing Resources)

`acm.totaltls`

edit()
update()

`cloudforceone.threatevents`

list()

`contentscanning`

create()
get()
update()

`dns.records`

scan_list()
scan_review()
scan_trigger()

`intel.indicatorfeeds`

create()
delete()
list()

`leakedcredentialchecks.detections`

get()

`queues.consumers`

list()

`radar.ai`

summary()
timeseries()
timeseries_groups()

`radar.bgp`

changes()
snapshot()

`workers.subdomains`

delete()

`zerotrust.networks`

create()
delete()
edit()
get()
list()

General Fixes and Improvements

Type System & Compatibility

Type inference improvements: Allow Pyright to properly infer TypedDict types within SequenceNotStr
Type completeness: Add missing types to method arguments and response models
Pydantic compatibility: Ensure compatibility with Pydantic versions prior to 2.8.0 when using additional fields

Request/Response Handling

Multipart form data: Correctly handle sending multipart/form-data requests with JSON data
Header handling: Do not send headers with default values set to omit
GET request headers: Don't send Content-Type header on GET requests
Response body model accuracy: Broad improvements to the correctness of models

Parsing & Data Processing

Discriminated unions: Correctly handle nested discriminated unions in response parsing
Extra field types: Parse extra field types correctly
Empty metadata: Ignore empty metadata fields during parsing
Singularization rules: Update resource name singularization rules for better consistency

Cloudflare Fundamentals - Introducing Markdown for Agents

Thu, 12 Feb 2026 00:00:00 GMT

Cloudflare's network now supports real-time content conversion at the source, for enabled zones using content negotiation ↗ headers. When AI systems request pages from any website that uses Cloudflare and has Markdown for Agents enabled, they can express the preference for text/markdown in the request: our network will automatically and efficiently convert the HTML to markdown, when possible, on the fly.

Here is a curl example with the Accept negotiation header requesting this page from our developer documentation:

curl https://developers.cloudflare.com/fundamentals/reference/markdown-for-agents/ \
  -H "Accept: text/markdown"

The response to this request is now formatted in markdown:

HTTP/2 200
date: Wed, 11 Feb 2026 11:44:48 GMT
content-type: text/markdown; charset=utf-8
content-length: 2899
vary: accept
x-markdown-tokens: 725
content-signal: ai-train=yes, search=yes, ai-input=yes

---
title: Markdown for Agents · Cloudflare Agents docs
---

## What is Markdown for Agents

Markdown has quickly become the lingua franca for agents and AI systems
as a whole. The format’s explicit structure makes it ideal for AI processing,
ultimately resulting in better results while minimizing token waste.
...

Refer to our developer documentation and our blog announcement ↗ for more details.

Cloudflare Fundamentals, Terraform - Terraform v5.17.0 now available

Thu, 12 Feb 2026 00:00:00 GMT

In January 2025, we announced the launch of the new Terraform v5 Provider. We greatly appreciate the proactive engagement and valuable feedback from the Cloudflare community following the v5 release. In response, we have established a consistent and rapid 2-3 week cadence ↗ for releasing targeted improvements, demonstrating our commitment to stability and reliability.

With the help of the community, we have a growing number of resources that we have marked as stable ↗, with that list continuing to grow with every release. The most used resources ↗ are on track to be stable by the end of March 2026, when we will also be releasing a new migration tool to help you migrate from v4 to v5 with ease.

This release brings new capabilities for AI Search, enhanced Workers Script placement controls, and numerous bug fixes based on community feedback. We also begun laying foundational work for improving the v4 to v5 migration process. Stay tuned for more details as we approach the March 2026 release timeline.

Thank you for continuing to raise issues. They make our provider stronger and help us build products that reflect your needs.

Features

ai_search_instance: add data source for querying AI Search instances
ai_search_token: add data source for querying AI Search tokens
account: add support for tenant unit management with new unit field
account: add automatic mapping from managed_by.parent_org_id to unit.id
authenticated_origin_pulls_certificate: add data source for querying authenticated origin pull certificates
authenticated_origin_pulls_hostname_certificate: add data source for querying hostname-specific authenticated origin pull certificates
authenticated_origin_pulls_settings: add data source for querying authenticated origin pull settings
workers_kv: add value field to data source to retrieve KV values directly
workers_script: add script field to data source to retrieve script content
workers_script: add support for simple rate limit binding
workers_script: add support for targeted placement mode with placement.target array for specifying placement targets (region, hostname, host)
workers_script: add placement_mode and placement_status computed fields
zero_trust_dex_test: add data source with filter support for finding specific tests
zero_trust_dlp_predefined_profile: add enabled_entries field for flexible entry management

Bug Fixes

account: map managed_by.parent_org_id to unit.id in unmarshall and add acceptance tests
authenticated_origin_pulls_certificate: add certificate normalization to prevent drift
authenticated_origin_pulls: handle array response and implement full lifecycle
authenticated_origin_pulls_hostname_certificate: fix resource and tests
cloudforce_one_request_message: use correct request_id field instead of id in API calls
dns_zone_transfers_incoming: use correct zone_id field instead of id in API calls
dns_zone_transfers_outgoing: use correct zone_id field instead of id in API calls
email_routing_settings: use correct zone_id field instead of id in API calls
hyperdrive_config: add proper handling for write-only fields to prevent state drift
hyperdrive_config: add normalization for empty mtls objects to prevent unnecessary diffs
magic_network_monitoring_rule: use correct account_id field instead of id in API calls
mtls_certificates: fix resource and test
pages_project: revert build_config to computed optional
stream_key: use correct account_id field instead of id in API calls
total_tls: use upsert pattern for singleton zone setting
waiting_room_rules: use correct waiting_room_id field instead of id in API calls
workers_script: add support for placement mode/status
zero_trust_access_application: update v4 version on migration tests
zero_trust_device_posture_rule: update tests to match API
zero_trust_dlp_integration_entry: use correct entry_id field instead of id in API calls
zero_trust_dlp_predefined_entry: use correct entry_id field instead of id in API calls
zero_trust_organization: fix plan issues

Chores

add state upgraders to 95+ resources to lay the foundation for replacing Grit (still under active development)
certificate_pack: add state migration handler for SDKv2 to Framework conversion
custom_hostname_fallback_origin: add comprehensive lifecycle test and migration support
dns_record: add state migration handler for SDKv2 to Framework conversion
leaked_credential_check: add import functionality and tests
load_balancer_pool: add state migration handler with detection for v4 vs v5 format
pages_project: add state migration handlers
tiered_cache: add state migration handlers
zero_trust_dlp_predefined_profile: deprecate entries field in favor of enabled_entries

For more information

Cloudflare Fundamentals - Added Timezone preferences settings

Tue, 27 Jan 2026 00:00:00 GMT

You can now set the timezone in the Cloudflare dashboard as Coordinated Universal Time (UTC) or your browser or system's timezone.

What's New

Unless otherwise specified in the user interface, all dates and times in the Cloudflare dashboard are now displayed in the selected timezone.

You can change the timezone setting from the user profile dropdown.

The page will reload to apply the new timezone setting.

Cloudflare Fundamentals - New 2FA Experience for Login

Fri, 23 Jan 2026 00:00:00 GMT

In an effort to improve overall user security, users without 2FA will be prompted upon login to enroll in email 2FA. This will improve user security posture while minimizing friction. Users without email 2FA enabled will see a prompt to secure their account with additional factors upon logging in. Enrolling in 2FA remains optional, but strongly encouraged as it is the best way to prevent account takeovers.

We also made changes to existing 2FA screens to improve the user experience. Now we have distinct experiences for each 2FA factor type, reflective of the way that factor works.

For more information

Configure Email Two Factor Authentication

Cloudflare Fundamentals, SDK - Cloudflare Typescript SDK v6.0.0-beta.1 now available

Tue, 20 Jan 2026 00:00:00 GMT

Disclaimer: Please note that v6.0.0-beta.1 is in Beta and we are still testing it for stability.

Full Changelog: v5.2.0...v6.0.0-beta.1 ↗

Some breaking changes were introduced due to bug fixes, also listed below.

Please ensure you read through the list of changes below before moving to this version - this will help you understand any down or upstream issues it may cause to your environments.

Breaking Changes

Addressing - Parameter Requirements Changed

BGPPrefixCreateParams.cidr: optional → required
PrefixCreateParams.asn: number | null → number
PrefixCreateParams.loa_document_id: required → optional
ServiceBindingCreateParams.cidr: optional → required
ServiceBindingCreateParams.service_id: optional → required

API Gateway

ConfigurationUpdateResponse removed
PublicSchema → OldPublicSchema
SchemaUpload → UserSchemaCreateResponse
ConfigurationUpdateParams.properties removed; use normalize

CloudforceOne - Response Type Changes

ThreatEventBulkCreateResponse: number → complex object with counts and errors

D1 Database - Query Parameters

DatabaseQueryParams: simple interface → union type (D1SingleQuery | MultipleQueries)
DatabaseRawParams: same change
Supports batch queries via batch array

DNS Records - Type Renames (21 types)

All record type interfaces renamed from *Record to short names:

RecordResponse.ARecord → RecordResponse.A
RecordResponse.AAAARecord → RecordResponse.AAAA
RecordResponse.CNAMERecord → RecordResponse.CNAME
RecordResponse.MXRecord → RecordResponse.MX
RecordResponse.NSRecord → RecordResponse.NS
RecordResponse.PTRRecord → RecordResponse.PTR
RecordResponse.TXTRecord → RecordResponse.TXT
RecordResponse.CAARecord → RecordResponse.CAA
RecordResponse.CERTRecord → RecordResponse.CERT
RecordResponse.DNSKEYRecord → RecordResponse.DNSKEY
RecordResponse.DSRecord → RecordResponse.DS
RecordResponse.HTTPSRecord → RecordResponse.HTTPS
RecordResponse.LOCRecord → RecordResponse.LOC
RecordResponse.NAPTRRecord → RecordResponse.NAPTR
RecordResponse.SMIMEARecord → RecordResponse.SMIMEA
RecordResponse.SRVRecord → RecordResponse.SRV
RecordResponse.SSHFPRecord → RecordResponse.SSHFP
RecordResponse.SVCBRecord → RecordResponse.SVCB
RecordResponse.TLSARecord → RecordResponse.TLSA
RecordResponse.URIRecord → RecordResponse.URI
RecordResponse.OpenpgpkeyRecord → RecordResponse.Openpgpkey

IAM Resource Groups

ResourceGroupCreateResponse.scope: optional single → required array
ResourceGroupCreateResponse.id: optional → required

Origin CA Certificates - Parameter Requirements Changed

OriginCACertificateCreateParams.csr: optional → required
OriginCACertificateCreateParams.hostnames: optional → required
OriginCACertificateCreateParams.request_type: optional → required

Pipelines - v0 to v1 Migration

Entire v0 API deprecated; use v1 methods (createV1, listV1, etc.)
New sub-resources: Sinks, Streams

R2

EventNotificationUpdateParams.rules: optional → required
Super Slurper: bucket, secret now required in source params

Radar

dataSource: string → typed enum (23 values)
eventType: string → typed enum (6 values)
V2 methods require dimension parameter (breaking signature change)

Removed: status_message field from all recipient response types

Schema Validation

Consolidated SchemaCreateResponse, SchemaListResponse, SchemaEditResponse, SchemaGetResponse → PublicSchema
Renamed: SchemaListResponsesV4PagePaginationArray → PublicSchemasV4PagePaginationArray

Spectrum

Renamed union members: AppListResponse.UnionMember0 → SpectrumConfigAppConfig
Renamed union members: AppListResponse.UnionMember1 → SpectrumConfigPaygoAppConfig

Workers

Removed: WorkersBindingKindTailConsumer type (all occurrences)
Renamed: ScriptsSinglePage → ScriptListResponsesSinglePage
Removed: DeploymentsSinglePage

Zero-Trust DLP

datasets.create(), update(), get() return types changed
PredefinedGetResponse union members renamed to UnionMember0-5

Zero-Trust Tunnels

Removed: CloudflaredCreateResponse, CloudflaredListResponse, CloudflaredDeleteResponse, CloudflaredEditResponse, CloudflaredGetResponse
Removed: CloudflaredListResponsesV4PagePaginationArray

Features

Abuse Reports (`client.abuseReports`)

Reports: create, list, get
Mitigations: sub-resource for abuse mitigations

AI Search (`client.aisearch`)

Instances: create, update, list, delete, read, stats
Items: list, get
Jobs: create, list, get, logs
Tokens: create, update, list, delete, read

Connectivity (`client.connectivity`)

Directory Services: create, update, list, delete, get
Supports IPv4, IPv6, dual-stack, and hostname configurations

Organizations (`client.organizations`)

Organizations: create, update, list, delete, get
OrganizationProfile: update, get
Hierarchical organization support with parent/child relationships

R2 Data Catalog (`client.r2DataCatalog`)

Catalog: list, enable, disable, get
Credentials: create
MaintenanceConfigs: update, get
Namespaces: list
Tables: list, maintenance config management
Apache Iceberg integration

Realtime Kit (`client.realtimeKit`)

Apps: get, post
Meetings: create, get, participant management
Livestreams: 10+ methods for streaming
Recordings: start, pause, stop, get
Sessions: transcripts, summaries, chat
Webhooks: full CRUD
ActiveSession: polls, kick participants
Analytics: organization analytics

Token Validation (`client.tokenValidation`)

Configuration: create, list, delete, edit, get
Credentials: update
Rules: create, list, delete, bulkCreate, bulkEdit, edit, get
JWT validation with RS256/384/512, PS256/384/512, ES256, ES384

Alerting Silences (`client.alerting.silences`)

create, update, list, delete, get

IAM SSO (`client.iam.sso`)

create, update, list, delete, get, beginVerification

Pipelines v1 (`client.pipelines`)

Sinks: create, list, delete, get
Streams: create, update, list, delete, get

Zero-Trust AI Controls / MCP (`client.zeroTrust.access.aiControls.mcp`)

Portals: create, update, list, delete, read
Servers: create, update, list, delete, read, sync

Accounts

managed_by field with parent_org_id, parent_org_name

Addressing LOA Documents

auto_generated field on LOADocumentCreateResponse

Addressing Prefixes

delegate_loa_creation, irr_validation_state, ownership_validation_state, ownership_validation_token, rpki_validation_state

AI

Added toMarkdown.supported() method to get all supported conversion formats

AI Gateway

zdr field added to all responses and params

Alerting

New alert type: abuse_report_alert
type field added to PolicyFilter

Browser Rendering

ContentCreateParams: refined to discriminated union (Variant0 | Variant1)
Split into URL-based and HTML-based parameter variants for better type safety

Client Certificates

reactivate parameter in edit

CloudforceOne

ThreatEventCreateParams.indicatorType: required → optional
hasChildren field added to all threat event response types
datasetIds query parameter on AttackerListParams, CategoryListParams, TargetIndustryListParams
categoryUuid field on TagCreateResponse
indicators array for multi-indicator support per event
uuid and preserveUuid fields for UUID preservation in bulk create
format query parameter ('json' | 'stix2') on ThreatEventListParams
createdAt, datasetId fields on ThreatEventEditParams

Content Scanning

Added create(), update(), get() methods

Custom Pages

New page types: basic_challenge, under_attack, waf_challenge

D1

served_by_colo - colo that handled query
jurisdiction - 'eu' | 'fedramp'
Time Travel (client.d1.database.timeTravel): getBookmark(), restore() - point-in-time recovery

Email Security

New fields on InvestigateListResponse/InvestigateGetResponse: envelope_from, envelope_to, postfix_id_outbound, replyto
New detection classification: 'outbound_ndr'
Enhanced Finding interface with attachment, detection, field, portion, reason, score
Added cursor query parameter to InvestigateListParams

Gateway Lists

New list types: CATEGORY, LOCATION, DEVICE

Intel

New issue type: 'configuration_suggestion'
payload field: unknown → typed Payload interface with detection_method, zone_tag

Leaked Credential Checks

Added detections.get() method

Logpush

New datasets: dex_application_tests, dex_device_state_events, ipsec_logs, warp_config_changes, warp_toggle_changes

Load Balancers

Monitor.port: number → number | null
Pool.load_shedding: LoadShedding → LoadShedding | null
Pool.origin_steering: OriginSteering → OriginSteering | null

Magic Transit

license_key field on connectors
provision_license parameter for auto-provisioning
IPSec: custom_remote_identities with FQDN support
Snapshots: Bond interface, probed_mtu field

Queues

Added subscriptions.get() method
Enhanced SubscriptionGetResponse with typed event source interfaces
New event source types: Images, KV, R2, Vectorize, Workers AI, Workers Builds, Workflows

R2

Sippy: new provider s3 (S3-compatible endpoints)
Sippy: bucketUrl field for S3-compatible sources
Super Slurper: keys field on source response schemas (specify specific keys to migrate)
Super Slurper: pathPrefix field on source schemas
Super Slurper: region field on S3 source params

Radar

Added geolocations.list(), geolocations.get() methods
Added V2 dimension-based methods (summaryV2, timeseriesGroupsV2) to radar sub-resources

Added terminal boolean field to Resource Error interfaces

Rules

Added id field to ItemDeleteParams.Item

Rulesets

New buffering fields on SetConfigRule: request_body_buffering, response_body_buffering

Secrets Store

New scopes: 'dex', 'access' (in addition to 'workers', 'ai_gateway')

SSL Certificate Packs

Response types now proper interfaces (was unknown)
Fields now required: id, certificates, hosts, status, type

Security Center

payload field: unknown → typed Payload interface with detection_method, zone_tag

Shared Types

Added: CloudflareTunnelsV4PagePaginationArray pagination class

Workers

Added subdomains.delete() method
Worker.references - track external dependencies (domains, Durable Objects, queues)
Worker.startup_time_ms - startup timing
Script.observability - observability settings with logging
Script.tag, Script.tags - immutable ID and tags
Placement: support for region, hostname, host-based placement
tags, tail_consumers now accept | null
Telemetry: traces field, $containers event info, durableObjectId, transactionName, abr_level fields

Workers for Platforms

ScriptUpdateResponse: new fields entry_point, observability, tag, tags
placement field now union of 4 variants (smart mode, region, hostname, host)
tags, tail_consumers now nullable
TagUpdateParams.body now accepts null

Workflows

instance_retention: unknown → typed InstanceRetention interface with error_retention, success_retention
New status option: 'restart' added to StatusEditParams.status

Zero-Trust Devices

External emergency disconnect settings (4 new fields)
antivirus device posture check type
os_version_extra documentation improvements

Zones

New response types: SubscriptionCreateResponse, SubscriptionUpdateResponse, SubscriptionGetResponse

Zero-Trust Access Applications

New ApplicationType values: 'mcp', 'mcp_portal', 'proxy_endpoint'
New destination type: ViaMcpServerPortalDestination for MCP server access

Zero-Trust Gateway

Added rules.listTenant() method

Zero-Trust Gateway - Proxy Endpoints

ProxyEndpoint: interface → discriminated union (ZeroTrustGatewayProxyEndpointIP | ZeroTrustGatewayProxyEndpointIdentity)
ProxyEndpointCreateParams: interface → union type
Added kind field: 'ip' | 'identity'

Zero-Trust Tunnels

WARPConnector*Response: union type → interface

Deprecations

API Gateway: UserSchemas, Settings, SchemaValidation resources
Audit Logs: auditLogId.not (use id.not)
CloudforceOne: ThreatEvents.get(), IndicatorTypes.list()
Devices: public_ip field (use DEX API)
Email Security: item_count field in Move responses
Pipelines: v0 methods (use v1)
Radar: old summary() and timeseriesGroups() methods (use V2)
Rulesets: disable_apps, mirage fields
WARP Connector: connections field
Workers: environment parameter in Domains
Zones: ResponseBuffering page rule

Bug Fixes

mcp: correct code tool API endpoint (599703c ↗)
mcp: return correct lines on typescript errors (5d6f999 ↗)
organization_profile: fix bad reference (d84ea77 ↗)
schema_validation: correctly reflect model to openapi mapping (bb86151 ↗)
workers: fix tests (2ee37f7 ↗)

Documentation

Added deprecation notices with migration paths
api_gateway: deprecate API Shield Schema Validation resources (8a4b20f ↗)
Improved JSDoc examples across all resources
workers: expose subdomain delete documentation (4f7cc1f ↗)

Cloudflare Fundamentals, Terraform - Terraform v5.16.0 now available

Tue, 20 Jan 2026 00:00:00 GMT

In January 2025, we announced the launch of the new Terraform v5 Provider. We greatly appreciate the proactive engagement and valuable feedback from the Cloudflare community following the v5 release. In response, we've established a consistent and rapid 2-3 week cadence ↗ for releasing targeted improvements, demonstrating our commitment to stability and reliability.

Thank you for continuing to raise issues. They make our provider stronger and help us build products that reflect your needs.

This release includes bug fixes, the stabilization of even more popular resources, and more.

Features

custom_pages: add "waf_challenge" as new supported error page type identifier in both resource and data source schemas
list: enhance CIDR validator to check for normalized CIDR notation requiring network address for IPv4 and IPv6
magic_wan_gre_tunnel: add automatic_return_routing attribute for automatic routing control
magic_wan_gre_tunnel: add BGP configuration support with new BGP model attribute
magic_wan_gre_tunnel: add bgp_status computed attribute for BGP connection status information
magic_wan_gre_tunnel: enhance schema with BGP-related attributes and validators
magic_wan_ipsec_tunnel: add automatic_return_routing attribute for automatic routing control
magic_wan_ipsec_tunnel: add BGP configuration support with new BGP model attribute
magic_wan_ipsec_tunnel: add bgp_status computed attribute for BGP connection status information
magic_wan_ipsec_tunnel: add custom_remote_identities attribute for custom identity configuration
magic_wan_ipsec_tunnel: enhance schema with BGP and identity-related attributes
ruleset: add request body buffering support
ruleset: enhance ruleset data source with additional configuration options
workers_script: add observability logs attributes to list data source model
workers_script: enhance list data source schema with additional configuration options

Bug Fixes

account_member: fix resource importability issues
dns_record: remove unnecessary fmt.Sprintf wrapper around LoadTestCase call in test configuration helper function
load_balancer: fix session_affinity_ttl type expectations to match Float64 in initial creation and Int64 after migration
workers_kv: handle special characters correctly in URL encoding

Documentation

account_subscription: update schema description for rate_plan.sets attribute to clarify it returns an array of strings
api_shield: add resource-level description for API Shield management of auth ID characteristics
api_shield: enhance auth_id_characteristics.name attribute description to include JWT token configuration format requirements
api_shield: specify JSONPath expression format for JWT claim locations
hyperdrive_config: add description attribute to name attribute explaining its purpose in dashboard and API identification
hyperdrive_config: apply description improvements across resource, data source, and list data source schemas
hyperdrive_config: improve schema descriptions for cache settings to clarify default values
hyperdrive_config: update port description to clarify defaults for different database types

For more information

Cloudflare Fundamentals - Enhanced HTTP/3 request cancellation visibility

Mon, 19 Jan 2026 00:00:00 GMT

Enhanced HTTP/3 request cancellation visibility

Cloudflare now provides more accurate visibility into HTTP/3 client request cancellations, giving you better insight into real client behavior and reducing unnecessary load on your origins.

Previously, when an HTTP/3 client cancelled a request, the cancellation was not always actioned immediately. This meant requests could continue through the CDN — potentially all the way to your origin — even after the client had abandoned them. In these cases, logs would show the upstream response status (such as 200 or a timeout-related code) rather than reflecting the client cancellation.

Now, Cloudflare terminates cancelled HTTP/3 requests immediately and accurately logs them with a 499 status code.

Better observability for client behavior

When HTTP/3 clients cancel requests, Cloudflare now immediately reflects this in your logs with a 499 status code. This gives you:

More accurate traffic analysis: Understand exactly when and how often clients cancel requests.
Clearer debugging: Distinguish between true errors and intentional client cancellations.
Better availability metrics: Separate client-initiated cancellations from server-side issues.

Reduced origin load

Cloudflare now terminates cancelled requests faster, which means:

Less wasted compute: Your origin no longer processes requests that clients have already abandoned.
Lower bandwidth usage: Responses are no longer generated and transmitted for cancelled requests.
Improved efficiency: Resources are freed up to handle active requests.

What to expect in your logs

You may notice an increase in 499 status codes for HTTP/3 traffic. For HTTP/3, a 499 indicates the client cancelled the request stream ↗ before receiving a complete response — the underlying connection may remain open. This is a normal part of web traffic.

Tip: If you use 499 codes in availability calculations, consider whether client-initiated cancellations should be excluded from error rates. These typically represent normal user behavior — such as closing a browser, navigating away from a page, mobile network drops, or cancelling a download — rather than service issues.

For more information, refer to Error 499.

Cloudflare Fundamentals, Terraform - Terraform v5.15.0 now available

Fri, 19 Dec 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence ↗ to ensure its stability and reliability, including the v5.15 release. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach ↗ - we will be focusing on specific resources to not only stabilize the resource but also ensure it is migration-friendly for those migrating from v4 to v5.

Thank you for continuing to raise issues. They make our provider stronger and help us build products that reflect your needs.

This release includes bug fixes, the stabilization of even more popular resources, and more.

Features

ai_search: Add AI Search endpoints (6f02adb ↗)
certificate_pack: Ensure proper Terraform resource ID handling for path parameters in API calls (081f32a ↗)
worker_version: Support startup_time_ms (286ab55 ↗)
zero_trust_dlp_custom_entry: Support upload_status (7dc0fe3 ↗)
zero_trust_dlp_entry: Support upload_status (7dc0fe3 ↗)
zero_trust_dlp_integration_entry: Support upload_status (7dc0fe3 ↗)
zero_trust_dlp_predefined_entry: Support upload_status (7dc0fe3 ↗)
zero_trust_gateway_policy: Support forensic_copy (5741fd0 ↗)
zero_trust_list: Support additional types (category, location, device) (5741fd0 ↗)

Bug fixes

access_rules: Add validation to prevent state drift. Ideally, we'd use Semantic Equality but since that isn't an option, this will remove a foot-gun. (4457791 ↗)
cloudflare_pages_project: Addressing drift issues (6edffcf ↗) (3db318e ↗)
cloudflare_worker: Can be cleanly imported (4859b52 ↗)
cloudflare_worker: Ensure clean imports (5b525bc ↗)
list_items: Add validation for IP List items to avoid inconsistent state (b6733dc ↗)
zero_trust_access_application: Remove all conditions from sweeper (3197f1a ↗)
spectrum_application: Map missing fields during spectrum resource import (#6495 ↗) (ddb4e72 ↗)

Upgrade to newer version

We suggest waiting to migrate to v5 while we work on stabilization. This helps with avoiding any blocking issues while the Terraform resources are actively being stabilized ↗. We will be releasing a new migration tool in March 2026 to help support v4 to v5 transitions for our most popular resources.

For more information

Cloudflare Fundamentals, Terraform - Terraform v5.14.0 now available

Fri, 05 Dec 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence ↗ to ensure its stability and reliability, including the v5.14 release. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach ↗ - we will be focusing on specific resources to not only stabilize the resource but also ensure it is migration-friendly for those migrating from v4 to v5.

Thank you for continuing to raise issues. They make our provider stronger and help us build products that reflect your needs.

This release includes bug fixes, the stabilization of even more popular resources, and more.

Deprecation notice

Resource affected: api_shield_discovery_operation

Cloudflare continuously discovers and updates API endpoints and web assets of your web applications. To improve the maintainability of these dynamic resources, we are working on reducing the need to actively engage with discovered operations.

The corresponding public API endpoint of discovered operations ↗ is not affected and will continue to be supported.

Features

pages_project: Add v4 -> v5 migration tests (#6506 ↗)

Bug fixes

account_members: Makes member policies a set (#6488 ↗)
pages_project: Ensures non empty refresh plans (#6515 ↗)
R2: Improves sweeper (#6512 ↗)
workers_kv: Ignores value import state for verify (#6521 ↗)
workers_script: No longer treats the migrations attribute as WriteOnly (#6489 ↗)
workers_script: Resolves resource drift when worker has unmanaged secret (#6504 ↗)
zero_trust_device_posture_rule: Preserves input.version and other fields (#6500 ↗) and (#6503 ↗)
zero_trust_dlp_custom_profile: Adds sweepers for dlp_custom_profile
zone_subscription|account_subscription: Adds partners_ent as valid enum for rate_plan.id (#6505 ↗)
zone: Ensures datasource model schema parity (#6487 ↗)
subscription: Updates import signature to accept account_id/subscription_id to import account subscription (#6510 ↗)

Upgrade to newer version

For more information

Cloudflare Fundamentals, Terraform - Terraform v5.13.0 now available

Thu, 20 Nov 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence ↗ to ensure its stability and reliability, including the v5.13 release. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach ↗ - we will be focusing on specific resources to not only stabilize the resource but also ensure it is migration-friendly for those migrating from v4 to v5.

Thank you for continuing to raise issues. They make our provider stronger and help us build products that reflect your needs.

This release includes new features, new resources and data sources, bug fixes, updates to our Developer Documentation, and more.

Breaking Change

Please be aware that there are breaking changes for the cloudflare_api_token and cloudflare_account_token resources. These changes eliminate configuration drift caused by policy ordering differences in the Cloudflare API.

For more specific information about the changes or the actions required, please see the detailed Repository changelog ↗.

Features

New resources and data sources added
- cloudflare_connectivity_directory
- cloudflare_sso_connector
- cloudflare_universal_ssl_setting
api_token+account_tokens: state upgrader and schema bump (#6472 ↗)
docs: make docs explicit when a resource does not have import support
magic_transit_connector: support self-serve license key (#6398 ↗)
worker_version: add content_base64 support
worker_version: boolean support for run_worker_first (#6407 ↗)
workers_script_subdomains: add import support (#6375 ↗)
zero_trust_access_application: add proxy_endpoint for ZT Access Application (#6453 ↗)
zero_trust_dlp_predefined_profile: Switch DLP Predefined Profile endpoints, introduce enabled_entries attribute

Bug Fixes

account_token: token policy order and nested resources (#6440 ↗)
allow r2_bucket_event_notification to be applied twice without failing (#6419 ↗)
cloudflare_worker+cloudflare_worker_version: import for the resources (#6357 ↗)
dns_record: inconsistent apply error (#6452 ↗)
pages_domain: resource tests (#6338 ↗)
pages_project: unintended resource state drift (#6377 ↗)
queue_consumer: id population (#6181 ↗)
workers_kv: multipart request (#6367 ↗)
workers_kv: updating workers metadata attribute to be read from endpoint (#6386 ↗)
workers_script_subdomain: add note to cloudflare_workers_script_subdomain about redundancy with cloudflare_worker (#6383 ↗)
workers_script: allow config.run_worker_first to accept list input
zero_trust_device_custom_profile_local_domain_fallback: drift issues (#6365 ↗)
zero_trust_device_custom_profile: resolve drift issues (#6364 ↗)
zero_trust_dex_test: correct configurability for 'targeted' attribute to fix drift
zero_trust_tunnel_cloudflared_config: remove warp_routing from cloudflared_config (#6471 ↗)

Upgrading

We suggest holding off on migration to v5 while we work on stabilization. This help will you avoid any blocking issues while the Terraform resources are actively being stabilized. We will be releasing a new migration tool in March 2026 to help support v4 to v5 transitions for our most popular resources.

For more info

Cloudflare Fundamentals - Introducing email two-factor authentication

Thu, 30 Oct 2025 00:00:00 GMT

Two-factor authentication (2FA) is one of the best ways to protect your account from the risk of account takeover. Cloudflare has offered phishing resistant 2FA options including hardware based keys (for example, a Yubikey) and app based TOTP (time-based one-time password) options which use apps like Google or Microsoft's Authenticator app. Unfortunately, while these solutions are very secure, they can be lost if you misplace the hardware based key, or lose the phone which includes that app. The result is that users sometimes get locked out of their accounts and need to contact support.

Today, we are announcing the addition of email as a 2FA factor for all Cloudflare accounts. Email 2FA is in wide use across the industry as a least common denominator for 2FA because it is low friction, loss resistant, and still improves security over username/password login only. We also know that most commercial email providers already require 2FA, so your email address is usually well protected already.

You can now enable email 2FA on the Cloudflare dashboard:

Go to Profile at the top right corner.
Select Authentication.
Under Two-Factor Authentication, select Set up.

Cloudflare is critical infrastructure, and you should protect it as such. Review the following best practices and make sure you are doing your part to secure your account:

Use a unique password for every website, including Cloudflare, and store it in a password manager like 1Password or Keeper. These services are cross-platform and simplify the process of managing secure passwords.
Use 2FA to make it harder for an attacker to get into your account in the event your password is leaked.
Store your backup codes securely. A password manager is the best place since it keeps the backup codes encrypted, but you can also print them and put them somewhere safe in your home.
If you use an app to manage your 2FA keys, enable cloud backup, so that you don't lose your keys in the event you lose your phone.
If you use a custom email domain to sign in, configure SSO.
If you use a public email domain like Gmail or Hotmail, you can also use social login with Apple, GitHub, or Google to sign in.
If you manage a Cloudflare account for work:
- Have at least two administrators in case one of them unexpectedly leaves your company.
- Use SCIM to automate permissions management for members in your Cloudflare account.

Cloudflare Fundamentals - Revamped Member Management UI

Thu, 30 Oct 2025 00:00:00 GMT

As Cloudflare's platform has grown, so has the need for precise, role-based access control. We’ve redesigned the Member Management experience in the Dashboard to help administrators more easily discover, assign, and refine permissions for specific principals.

What's New

Refreshed member invite flow

We overhauled the Invite Members UI to simplify inviting users and assigning permissions.

Refreshed Members Overview Page

We've updated the Members Overview Page to clearly display:

Member 2FA status
Which members hold Super Admin privileges
API access settings per member
Member onboarding state (accepted vs pending invite)

New Member Permission Policies Details View

We've created a new member details screen that shows all permission policies associated with a member; including policies inherited from group associations to make it easier for members to understand the effective permissions they have.

Improved Member Permission Workflow

We redesigned the permission management experience to make it faster and easier for administrators to review roles and grant access.

Account-scoped Policies Restrictions Relaxed

Previously, customers could only associate a single account-scoped policy with a member. We've relaxed this restriction, and now Administrators can now assign multiple account-scoped policies to the same member; bringing policy assignment behavior in-line with user-groups and providing greater flexibility in managing member permissions.

Cloudflare Fundamentals - Increased HTTP header size limit to 128 KB

Thu, 16 Oct 2025 00:00:00 GMT

CDN now supports 128 KB request and response headers 🚀

We're excited to announce a significant increase in the maximum header size supported by Cloudflare's Content Delivery Network (CDN). Cloudflare now supports up to 128 KB for both request and response headers.

Previously, customers were limited to a total of 32 KB for request or response headers, with a maximum of 16 KB per individual header. Larger headers could cause requests to fail with HTTP 413 (Request Header Fields Too Large) errors.

What's new?

Support for large headers: You can now utilize much larger headers, whether as a single large header up to 128 KB or split over multiple headers.
Reduces 413 and 520 HTTP errors: This change drastically reduces the likelihood of customers encountering HTTP 413 errors from large request headers or HTTP 520 errors caused by oversized response headers, improving the overall reliability of your web applications.
Enhanced functionality: This is especially beneficial for applications that rely on:
- A large number of cookies.
- Large Content-Security-Policy (CSP) response headers.
- Advanced use cases with Cloudflare Workers that generate large response headers.

This enhancement improves compatibility with Cloudflare's CDN, enabling more use cases that previously failed due to header size limits.

To learn more and get started, refer to the Cloudflare Fundamentals documentation.

Cloudflare Fundamentals - Single sign-on now manageable in the user experience

Tue, 14 Oct 2025 00:00:00 GMT

During Birthday Week, we announced that single sign-on (SSO) is available for free ↗ to everyone who signs in with a custom email domain and maintains a compatible identity provider ↗. SSO minimizes user friction around login and provides the strongest security posture available. At the time, this could only be configured using the API.

Today, we are launching a new user experience which allows users to manage their SSO configuration from within the Cloudflare dashboard. You can access this by going to Manage account > Members > Settings.

For more information

Cloudflare dashboard SSO

Cloudflare Fundamentals - Automated reminders for backup codes

Tue, 07 Oct 2025 00:00:00 GMT

The most common reason users contact Cloudflare support is lost two-factor authentication (2FA) credentials. Cloudflare supports both app-based and hardware keys for 2FA, but you could lose access to your account if you lose these. Over the past few weeks, we have been rolling out email and in-product reminders that remind you to also download backup codes (sometimes called recovery keys) that can get you back into your account in the event you lose your 2FA credentials. Download your backup codes now by logging into Cloudflare, then navigating to Profile > Security & Authentication > Backup codes.

Cloudflare is critical infrastructure, and you should protect it as such. Please review the following best practices and make sure you are doing your part to secure your account.

Use a unique password for every website, including Cloudflare, and store it in a password manager like 1Password or Keeper. These services are cross-platform and simplify the process of managing secure passwords.
Use 2FA to make it harder for an attacker to get into your account in the event your password is leaked
Store your backup codes securely. A password manager is the best place since it keeps the backup codes encrypted, but you can also print them and put them somewhere safe in your home.
If you use an app to manage your 2FA keys, enable cloud backup, so that you don't lose your keys in the event you lose your phone.
If you use a custom email domain to sign in, configure SSO ↗.
If you use a public email domain like Gmail or Hotmail, you can also use social login with Apple, GitHub, or Google to sign in.
If you manage a Cloudflare account for work:
- Have at least two administrators in case one of them unexpectedly leaves your company
- Use SCIM to automate permissions management for members in your Cloudflare account

Cloudflare Fundamentals, Access - Fine-grained Permissioning for Access for Apps, IdPs, & Targets now in Public Beta

Thu, 02 Oct 2025 00:00:00 GMT

Fine-grained permissions for Access Applications, Identity Providers (IdPs), and Targets is now available in Public Beta. This expands our RBAC model beyond account & zone-scoped roles, enabling administrators to grant permissions scoped to individual resources.

What's New

Access Applications ↗: Grant admin permissions to specific Access Applications.
Identity Providers ↗: Grant admin permissions to individual Identity Providers.
Targets ↗: Grant admin rights to specific Targets

For more info:

Cloudflare Fundamentals - Return markdown

Wed, 01 Oct 2025 00:00:00 GMT

Users can now specify that they want to retrieve Cloudflare documentation as markdown rather than the previous HTML default. This can significantly reduce token consumption when used alongside Large Language Model (LLM) tools.

curl https://developers.cloudflare.com/workers/ -H 'Accept: text/markdown'  -v

If you maintain your own site and want to adopt this practice using Cloudflare Workers for your own users you can follow the example here ↗.

Cloudflare Fundamentals - Sign in with GitHub

Thu, 25 Sep 2025 00:00:00 GMT

Cloudflare has launched sign in with GitHub as a log in option. This feature is available to all users with a verified email address who are not using SSO. To use it, simply click on the Sign in with GitHub button on the dashboard login page. You will be logged in with your primary GitHub email address.

For more information

Cloudflare Fundamentals - SSO for all

Thu, 25 Sep 2025 00:00:00 GMT

Single sign-on (SSO) streamlines the process of logging into Cloudflare for Enterprise customers who manage a custom email domain and manage their own identity provider. Instead of managing a password and two-factor authentication credentials directly for Cloudflare, SSO lets you reuse your existing login infrastructure to seamlessly log in. SSO also provides additional security opportunities such as device health checks which are not available natively within Cloudflare.

Historically, SSO was only available for Enterprise accounts. Today, we are announcing that we are making SSO available to all users for free. We have also added the ability to directly manage SSO configurations using the API. This removes the previous requirement to contact support to configure SSO.

For more information

Cloudflare Fundamentals - Reminders about two-factor authentication backup codes

Mon, 08 Sep 2025 00:00:00 GMT

Two-factor authentication is the best way to help protect your account from account takeovers, but if you lose your second factor, you could be locked out of your account. Lock outs are one of the top reasons customers contact Cloudflare support, and our policies often don't allow us to bypass two-factor authentication for customers that are locked out. Today we are releasing an improvement where Cloudflare will periodically remind you to securely save your backup codes so you don't get locked out in the future.

For more information

Two-factor authentication

Cloudflare Fundamentals - Introducing new headers for rate limiting on Cloudflare's API

Wed, 03 Sep 2025 00:00:00 GMT

Cloudflare's API now supports rate limiting headers using the pattern developed by the IETF draft on rate limiting ↗. This allows API consumers to know how many more calls are left until the rate limit is reached, as well as how long you will need to wait until more capacity is available.

Our SDKs automatically work with these new headers, backing off when rate limits are approached. There is no action required for users of the latest Cloudflare SDKs to take advantage of this.

As always, if you need any help with rate limits, please contact Support.

Changes

New Headers

Headers that are always returned:

Ratelimit: List of service limit items, composed of the limit name, the remaining quota (r) and the time next window resets (t). For example: "default";r=50;t=30
Ratelimit-Policy: List of quota policy items, composed of the policy name, the total quota (q) and the time window the quota applies to (w). For example: "burst";q=100;w=60

Returned only when a rate limit has been reached (error code: 429):

Retry-After: Number of Seconds until more capacity is available, rounded up

SDK Back offs

All of Cloudflare's latest SDKs will automatically respond to the headers, instituting a backoff when limits are approached.

GraphQL and Edge APIs

These new headers and back offs are only available for Cloudflare REST APIs, and will not affect GraphQL.

For more information

Rate limits at Cloudflare ↗

Cloudflare Fundamentals, Terraform - Terraform v5.9 now available

Fri, 29 Aug 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues ↗ reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2 week cadence to ensure its stability and reliability, including the v5.9 release. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach - we will be focusing on specific resources for every release, stabilizing the release, and closing all associated bugs with that resource before moving onto resolving migration issues.

Thank you for continuing to raise issues. We triage them weekly and they help make our products stronger.

This release includes a new resource, cloudflare_snippet, which replaces cloudflare_snippets. cloudflare_snippet is now considered deprecated but can still be used. Please utilize cloudflare_snippet as soon as possible.

Changes

Resources stabilized:
- cloudflare_zone_setting
- cloudflare_worker_script
- cloudflare_worker_route
- tiered_cache
NEW resource cloudflare_snippet which should be used in place of cloudflare_snippets. cloudflare_snippets is now deprecated. This enables the management of Cloudflare's snippet functionality through Terraform.
DNS Record Improvements: Enhanced handling of DNS record drift detection
Load Balancer Fixes: Resolved created_on field inconsistencies and improved pool configuration handling
Bot Management: Enhanced auto-update model state consistency and fight mode configurations
Other bug fixes

For a more detailed look at all of the changes, refer to the changelog ↗ in GitHub.

Issues Closed

If you have an unaddressed issue with the provider, we encourage you to check the open issues ↗ and open a new issue if one does not already exist for what you are experiencing.

Upgrading

We suggest holding off on migration to v5 while we work on stabilization. This help will you avoid any blocking issues while the Terraform resources are actively being stabilized.

If you'd like more information on migrating from v4 to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition. These do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository ↗.

For more info

Cloudflare Fundamentals, Terraform - Terraform v5.8.4 now available

Fri, 15 Aug 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues ↗ reported by the Cloudflare Community related to the v5 release. We have committed to releasing improvements on a two week cadence to ensure stability and reliability.

One key change we adopted in recent weeks is a pivot to more comprehensive, test-driven development. We are still evaluating individual issues, but are also investing in much deeper testing to drive our stabilization efforts. We will subsequently be investing in comprehensive migration scripts. As a result, you will see several of the highest traffic APIs have been stabilized in the most recent release, and are supported by comprehensive acceptance tests.

Thank you for continuing to raise issues. We triage them weekly and they help make our products stronger.

Changes

Resources stabilized:
- cloudflare_argo_smart_routing
- cloudflare_bot_management
- cloudflare_list
- cloudflare_list_item
- cloudflare_load_balancer
- cloudflare_load_balancer_monitor
- cloudflare_load_balancer_pool
- cloudflare_spectrum_application
- cloudflare_managed_transforms
- cloudflare_url_normalization_settings
- cloudflare_snippet
- cloudflare_snippet_rules
- cloudflare_zero_trust_access_application
- cloudflare_zero_trust_access_group
- cloudflare_zero_trust_access_identity_provider
- cloudflare_zero_trust_access_mtls_certificate
- cloudflare_zero_trust_access_mtls_hostname_settings
- cloudflare_zero_trust_access_policy
- cloudflare_zone
Multipart handling restored for cloudflare_snippet
cloudflare_bot_management diff issues resolves when running terraform plan and terraform apply
Other bug fixes

For a more detailed look at all of the changes, refer to the changelog ↗ in GitHub.

Issues Closed

If you have an unaddressed issue with the provider, we encourage you to check the open issues ↗ and open a new one if one does not already exist for what you are experiencing.

Upgrading

We suggest holding off on migration to v5 while we work on stabilization. This will help you avoid any blocking issues while the Terraform resources are actively being stabilized.

If you'd like more information on migrating to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition. These migration scripts do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository ↗.

For more info

Cloudflare Fundamentals, Terraform - Terraform v5.8.2 now available

Fri, 01 Aug 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues ↗ reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2 week cadeance to ensure it's stability and reliability. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach - we will be focusing on specific resources for every release, stabilizing the release and closing all associated bugs with that resource before moving onto resolving migration issues.

Thank you for continuing to raise issues. We triage them weekly and they help make our products stronger.

Changes

Resources stabilized:
- cloudflare_custom_pages
- cloudflare_page_rule
- cloudflare_dns_record
- cloudflare_argo_tiered_caching
Addressed chronic drift issues in cloudflare_logpush_job, cloudflare_zero_trust_dns_location, cloudflare_ruleset & cloudflare_api_token
cloudflare_zone_subscription returns expected values rate_plan.id from former versions
cloudflare_workers_script can now successfully be destroyed with bindings & migration for Durable Objects now recorded in tfstate
Ability to configure add_headers under cloudflare_zero_trust_gateway_policy
Other bug fixes

For a more detailed look at all of the changes, see the changelog ↗ in GitHub.

Issues Closed

If you have an unaddressed issue with the provider, we encourage you to check the open issues ↗ and open a new one if one does not already exist for what you are experiencing.

Upgrading

We suggest holding off on migration to v5 while we work on stabilization. This help will you avoid any blocking issues while the Terraform resources are actively being stabilized.

If you'd like more information on migrating from v4 to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition, although these do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository ↗.

For more info

Cloudflare Fundamentals, Terraform - Terraform v5.7.0 now available

Mon, 14 Jul 2025 00:00:00 GMT

Thank you for continuing to raise issues and please keep an eye on this changelog for more information about upcoming releases.

Changes

Addressed permanent diff bug on Cloudflare Tunnel config
State is now saved correctly for Zero Trust Access applications
Exact match is now working as expected within data.cloudflare_zero_trust_access_applications
cloudflare_zero_trust_access_policy now supports OIDC claims & diff issues resolved
Self hosted applications with private IPs no longer require a public domain for cloudflare_zero_trust_access_application.
New resource:
- cloudflare_zero_trust_tunnel_warp_connector
Other bug fixes

For a more detailed look at all of the changes, see the changelog ↗ in GitHub.

Issues Closed

If you have an unaddressed issue with the provider, we encourage you to check the open issues ↗ and open a new one if one does not already exist for what you are experiencing.

Upgrading

We suggest holding on migration to v5 while we work on stabilization of the v5 provider. This will ensure Cloudflare can work ahead and avoid any blocking issues.

If you'd like more information on migrating from v4 to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition, although these do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository ↗.

For more info

Cloudflare Fundamentals - Cloudflare User Groups & SCIM User Groups are now in GA

Mon, 23 Jun 2025 00:00:00 GMT

We're announcing the GA of User Groups for Cloudflare Dashboard and System for Cross Domain Identity Management (SCIM) User Groups, strengthening our RBAC capabilities with stable, production-ready primitives for managing access at scale.

What's New

User Groups [GA]: User Groups are a new Cloudflare IAM primitive that enable administrators to create collections of account members that are treated equally from an access control perspective. User Groups can be assigned permission policies, with individual members in the group inheriting all permissions granted to the User Group. User Groups can be created manually or via our APIs.

SCIM User Groups [GA]: Centralize & simplify your user and group management at scale by syncing memberships directly from your upstream identity provider (like Okta or Entra ID) to the Cloudflare Platform. This ensures Cloudflare stays in sync with your identity provider, letting you apply Permission Policies to those synced groups directly within the Cloudflare Dashboard.

Stability & Scale: These features have undergone extensive testing during the Public Beta period and are now ready for production use across enterprises of all sizes.

For more info:

Cloudflare Fundamentals, Terraform - Terraform v5.6.0 now available

Tue, 17 Jun 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. Unlike the earlier Terraform providers, v5 is automatically generated based on the OpenAPI Schemas for our REST APIs. Since launch, we have seen an unexpectedly high number of issues ↗ reported by customers. These issues currently impact about 15% of resources. We have been working diligently to address these issues across the company, and have released the v5.6.0 release which includes a number of bug fixes. Please keep an eye on this changelog for more information about upcoming releases.

Changes

Broad fixes across resources with recurring diffs, including, but not limited to:
- cloudflare_zero_trust_access_identity_provider
  - cloudflare_zone
cloudflare_page_rules runtime panic when setting cache_level to cache_ttl_by_status
Failure to serialize requests in cloudflare_zero_trust_tunnel_cloudflared_config
Undocumented field 'priority' on zone_lockdown resource
Missing importability for cloudflare_zero_trust_device_default_profile_local_domain_fallback and cloudflare_account_subscription
New resources:
- cloudflare_schema_validation_operation_settings
- cloudflare_schema_validation_schemas
- cloudflare_schema_validation_settings
- cloudflare_zero_trust_device_settings
Other bug fixes

For a more detailed look at all of the changes, see the changelog ↗ in GitHub.

Issues Closed

If you have an unaddressed issue with the provider, we encourage you to check the open issues ↗ and open a new one if one does not already exist for what you are experiencing.

Upgrading

If you are evaluating a move from v4 to v5, please make use of the migration guide ↗. We have provided automated migration scripts using Grit which simplify the transition, although these do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of terraform plan to test your changes before applying, and let us know if you encounter any additional issues by reporting to our GitHub repository ↗.

For more info

Cloudflare Fundamentals - Cloudflare User Groups & Enhanced Permission Policies are now in Beta

Mon, 02 Jun 2025 00:00:00 GMT

We're excited to announce the Public Beta launch of User Groups for Cloudflare Dashboard and System for Cross Domain Identity Management (SCIM) User Groups, expanding our RBAC capabilities to simplify user and group management at scale.

We've also visually overhauled the Permission Policies UI to make defining permissions more intuitive.

What's New

User Groups [BETA]: User Groups are a new Cloudflare IAM primitive that enable administrators to create collections of account members that are treated equally from an access control perspective. User Groups can be assigned permission policies, with individual members in the group inheriting all permissions granted to the User Group. User Groups can be created manually or via our APIs.

SCIM User Groups [BETA]: Centralize & simplify your user and group management at scale by syncing memberships directly from your upstream identity provider (like Okta or Entra ID) to the Cloudflare Platform. This ensures Cloudflare stays in sync with your identity provider, letting you apply Permission Policies to those synced groups directly within the Cloudflare Dashboard.

Revamped Permission Policies UI [BETA]: As Cloudflare's services have grown, so has the need for precise, role-based access control. We've given the Permission Policies builder a visual overhaul to make it much easier for administrators to find and define the exact permissions they want for specific principals.

For more info:

Cloudflare Fundamentals, Terraform - Terraform v5.5.0 now available

Mon, 19 May 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. Unlike the earlier Terraform providers, v5 is automatically generated based on the OpenAPI Schemas for our REST APIs. Since launch, we have seen an unexpectedly high number of issues ↗ reported by customers. These issues currently impact about 15% of resources. We have been working diligently to address these issues across the company, and have released the v5.5.0 release which includes a number of bug fixes. Please keep an eye on this changelog for more information about upcoming releases.

Changes

Broad fixes across resources with recurring diffs, including, but not limited to:
- cloudflare_zero_trust_gateway_policy
- cloudflare_zero_trust_access_application
- cloudflare_zero_trust_tunnel_cloudflared_route
- cloudflare_zone_setting
- cloudflare_ruleset
- cloudflare_page_rule
Zone settings can be re-applied without client errors
Page rules conversion errors are fixed
Failure to apply changes to cloudflare_zero_trust_tunnel_cloudflared_route
Other bug fixes

For a more detailed look at all of the changes, see the changelog ↗ in GitHub.

Issues Closed

If you have an unaddressed issue with the provider, we encourage you to check the open issues ↗ and open a new one if one does not already exist for what you are experiencing.

Upgrading

For more info

Cloudflare Fundamentals, Terraform - Terraform v5.4.0 now available

Tue, 06 May 2025 00:00:00 GMT

Earlier this year, we announced the launch of the new Terraform v5 Provider. Unlike the earlier Terraform providers, v5 is automatically generated based on the OpenAPI Schemas for our REST APIs. Since launch, we have seen an unexpectedly high number of issues ↗ reported by customers. These issues currently impact about 15% of resources. We have been working diligently to address these issues across the company, and have released the v5.4.0 release which includes a number of bug fixes. Please keep an eye on this changelog for more information about upcoming releases.

Changes

Removes the worker_platforms_script_secret resource from the provider (see migration guide ↗ for alternatives—applicable to both Workers and Workers for Platforms)
Removes duplicated fields in cloudflare_cloud_connector_rules resource
Fixes cloudflare_workers_route id issues #5134 ↗ #5501 ↗
Fixes issue around refreshing resources that have unsupported response types
Affected resources
- cloudflare_certificate_pack
- cloudflare_registrar_domain
- cloudflare_stream_download
- cloudflare_stream_webhook
- cloudflare_user
- cloudflare_workers_kv
- cloudflare_workers_script
Fixes cloudflare_workers_kv state refresh issues
Fixes issues around configurability of nested properties without computed values for the following resources
Affected resources
- cloudflare_account
- cloudflare_account_dns_settings
- cloudflare_account_token
- cloudflare_api_token
- cloudflare_cloud_connector_rules
- cloudflare_custom_ssl
- cloudflare_d1_database
- cloudflare_dns_record
- email_security_trusted_domains
- cloudflare_hyperdrive_config
- cloudflare_keyless_certificate
- cloudflare_list_item
- cloudflare_load_balancer
- cloudflare_logpush_dataset_job
- cloudflare_magic_network_monitoring_configuration
- cloudflare_magic_transit_site
- cloudflare_magic_transit_site_lan
- cloudflare_magic_transit_site_wan
- cloudflare_magic_wan_static_route
- cloudflare_notification_policy
- cloudflare_pages_project
- cloudflare_queue
- cloudflare_queue_consumer
- cloudflare_r2_bucket_cors
- cloudflare_r2_bucket_event_notification
- cloudflare_r2_bucket_lifecycle
- cloudflare_r2_bucket_lock
- cloudflare_r2_bucket_sippy
- cloudflare_ruleset
- cloudflare_snippet_rules
- cloudflare_snippets
- cloudflare_spectrum_application
- cloudflare_workers_deployment
- cloudflare_zero_trust_access_application
- cloudflare_zero_trust_access_group
Fixed defaults that made cloudflare_workers_script fail when using Assets
Fixed Workers Logpush setting in cloudflare_workers_script mistakenly being readonly
Fixed cloudflare_pages_project broken when using "source"

The detailed changelog ↗ is available on GitHub.

Upgrading

For more info

Cloudflare Fundamentals - Updates to Account Home - Quick actions, traffic insights, Workers projects, and more

Wed, 26 Mar 2025 06:00:00 GMT

Recently, Account Home has been updated to streamline your workflows:

Recent Workers projects: You'll now find your projects readily accessible from a new Developer Platform tab on Account Home. See recently-modified projects and explore what you can work our developer-focused products.
Traffic and security insights: Get a snapshot of domain performance at a glance with key metrics and trends.
Quick actions: You can now perform common actions for your account, domains, and even Workers in just 1-2 clicks from the 3-dot menu.
Keep starred domains front and center: Now, when you filter for starred domains on Account Home, we'll save your preference so you'll continue to only see starred domains by default.

We can't wait for you to take the new Account Home for a spin.

For more info:

Cloudflare Fundamentals, Terraform - Dozens of Cloudflare Terraform Provider resources now have proper drift detection

Fri, 21 Mar 2025 00:00:00 GMT

In Cloudflare Terraform Provider ↗ versions 5.2.0 and above, dozens of resources now have proper drift detection. Before this fix, these resources would indicate they needed to be updated or replaced — even if there was no real change. Now, you can rely on your terraform plan to only show what resources are expected to change.

This issue affected resources ↗ related to these products and features:

API Shield
Argo Smart Routing
Argo Tiered Caching
Bot Management
BYOIP
D1
DNS
Email Routing
Hyperdrive
Observatory
Pages
R2
Rules
SSL/TLS
Waiting Room
Workers
Zero Trust

Cloudflare Fundamentals, Terraform - Cloudflare Terraform Provider now properly redacts sensitive values

Fri, 21 Mar 2025 00:00:00 GMT

In the Cloudflare Terraform Provider ↗ versions 5.2.0 and above, sensitive properties of resources are redacted in logs. Sensitive properties in Cloudflare's OpenAPI Schema ↗ are now annotated with x-sensitive: true. This results in proper auto-generation of the corresponding Terraform resources, and prevents sensitive values from being shown when you run Terraform commands.

This issue affected resources ↗ related to these products and features:

Alerts and Audit Logs
Device API
DLP
DNS
Magic Visibility
Magic WAN
TLS Certs and Hostnames
Tunnels
Turnstile
Workers
Zaraz

Cloudflare Fundamentals, Terraform - Terraform v5 Provider is now generally available

Mon, 03 Feb 2025 00:00:00 GMT

Cloudflare's v5 Terraform Provider is now generally available. With this release, Terraform resources are now automatically generated based on OpenAPI Schemas. This change brings alignment across our SDKs, API documentation, and now Terraform Provider. The new provider boosts coverage by increasing support for API properties to 100%, adding 25% more resources, and more than 200 additional data sources. Going forward, this will also reduce the barriers to bringing more resources into Terraform across the broader Cloudflare API. This is a small, but important step to making more of our platform manageable through GitOps, making it easier for you to manage Cloudflare just like you do your other infrastructure.

The Cloudflare Terraform Provider v5 is a ground-up rewrite of the provider and introduces breaking changes for some resource types. Please refer to the upgrade guide ↗ for best practices, or the blog post on automatically generating Cloudflare's Terraform Provider ↗ for more information about the approach.

For more info

Cloudflare changelogs | Cloudflare Fundamentals

Cloudflare Fundamentals - Improved publisher verification details on OAuth consent screens

Cloudflare Fundamentals - Create Free accounts from the dashboard

Limitations

Next steps

Cloudflare Fundamentals - Account Role API deprecated

What you need to do

Highlights

Cloudflare Fundamentals, Organizations - Distributor, MSSP, and Agency partners can manage Organization members directly

Cloudflare Fundamentals - Origin Content Signals for Markdown for Agents

Gateway, Cloudflare One, Cloudflare Fundamentals - New permissions and roles for Gateway policies and lists

What is new

Get started

Cloudflare Fundamentals - Search API tokens by name

What's new

Cloudflare Fundamentals, Workers, D1, R2, KV, Queues, Vectorize, Durable Objects, Containers - Billable usage and budget alerts now in product sidebars

Cloudflare Fundamentals - Introducing self-managed OAuth clients

What is new

Create an application

Select limited scopes

Apps for both private and public use

Client domain verification

Learn more

Cloudflare Fundamentals, Cloudflare One, Cloudflare Tunnel for SASE, Cloudflare Tunnel, Cloudflare Mesh - Granular permissions for Cloudflare Tunnel and Cloudflare Mesh

What is new

How it works

Get started

Cloudflare Fundamentals - Keyboard shortcuts for the Cloudflare dashboard

Navigate

Take action

Cloudflare Fundamentals - Instant Bank Payments via Link

What changed

How to use it

Who is eligible

Cloudflare Fundamentals - Structured error responses for Cloudflare 5xx errors

Changes

Negotiation behavior

Availability

Get started

Cloudflare Fundamentals, Resource Tagging - Resource Tagging enters public beta

What's included

API-first by design

Dashboard UI

What's coming next

Current limitations

Cloudflare Fundamentals - Network Overview page in the dashboard

Cloudflare Fundamentals, Workers - Introducing Billable Usage dashboard and Budget alerts

Billable Usage dashboard

Budget alerts

Cloudflare Fundamentals - Improved OAuth experience for consent and management

What's new

Choose which accounts to authorize

Clear consent screens

Revoke access anytime

Why this matters

Learn more

Cloudflare Fundamentals - API tokens now detectable by secret scanning tools

What changed

Why this matters

What happens when a leak is detected

Supported platforms

Cloudflare Fundamentals, Cloudflare One, Gateway, Organizations - Organizations is now in public beta for enterprises

Cloudflare Fundamentals - Service Key authentication deprecated

What you need to do

Cloudflare Fundamentals - SCIM provisioning for Authentik is now Generally Available

Cloudflare Fundamentals - SCIM audit logging Support

Cloudflare Fundamentals - Retry-After HTTP header for retryable 1xxx errors

Changes

Availability

Verify

Cloudflare Fundamentals - JSON responses and RFC 9457 support for Cloudflare 1xxx errors

Breaking change

Changes

Negotiation behavior

Availability

Get started

Cloudflare Fundamentals - Markdown responses for Cloudflare 1xxx errors

Negotiation behavior

Availability

Get started

`acm.totaltls`

`cloudforceone.threatevents`

`contentscanning`

`dns.records`

`intel.indicatorfeeds`

`leakedcredentialchecks.detections`

`queues.consumers`

`radar.ai`

`radar.bgp`

`workers.subdomains`

`zerotrust.networks`

Abuse Reports (`client.abuseReports`)

AI Search (`client.aisearch`)

Connectivity (`client.connectivity`)

Organizations (`client.organizations`)

R2 Data Catalog (`client.r2DataCatalog`)

Realtime Kit (`client.realtimeKit`)

Token Validation (`client.tokenValidation`)

Alerting Silences (`client.alerting.silences`)

IAM SSO (`client.iam.sso`)

Pipelines v1 (`client.pipelines`)

Zero-Trust AI Controls / MCP (`client.zeroTrust.access.aiControls.mcp`)