Scoped Cloudflare credentials for AI agents
Cloudflare automation can change DNS answers, routing, cache behavior, Workers configuration, and security settings; a small credential mistake can therefore create an outage or expose a service. Build the provider-side boundary first with an API token limited to the required account or zone and permission, rather than using a global API key. Verify the zone identifier, token permission group, IP or client restrictions if used, and whether the task truly requires write access. Gazebo then delivers that deliberately narrow token only to the named agent or deployment workflow.
Why scope Cloudflare credentials for AI agents?
Cloudflare token permissions and resource scope define what an agent can do after it receives a token. Gazebo cannot reduce an account-wide Zone DNS Edit token into a single-zone token at retrieval time, so use Cloudflare’s zone/resource selection and minimum permission groups as the hard boundary. Gazebo adds per-agent issuance, denial, and revocation evidence. For an incident, remove the agent grant immediately, revoke the Cloudflare token if copied, and consult Cloudflare audit logs and DNS history to identify changes; retrieval is not itself evidence that a record was edited.
How it works
- 1
Create a Cloudflare API token with a specific zone or account resource and only the permission needed, such as Zone DNS Edit for a DNS automation; avoid global API keys.
- 2
Store tokens for DNS, deployment, and security operations separately and map each to the relevant Gazebo agent profile.
- 3
The approved agent requests its credential through MCP, where Gazebo checks the profile before returning the token.
- 4
Correlate Gazebo retrieval records with Cloudflare audit events, DNS change history, deployment events, and monitoring alerts. Plan rollback for TTL, proxy, and cache changes before unattended execution.
- 5
Disable the profile to stop new retrievals. Revoke the Cloudflare token and issue a replacement if it may have been exposed, then validate zone configuration and propagation after containment.
Common use cases
DNS configuration with minimal blast radius
Create a token scoped to the specific zone and the Zone DNS Edit permission, then make that credential available only to the DNS agent profile. Confirm that the automation cannot select an arbitrary zone ID and that changes are validated against the intended record set. DNS propagation and cached resolvers mean a correct rollback may not be instantly visible.
Audit DNS changes
Gazebo records the agent’s request for the token, including denied attempts; Cloudflare’s audit trail identifies provider-side changes. Use both during an outage, together with deployment and monitoring timestamps. Removing the Gazebo profile prevents future fetches but does not retract a token already held by a process, so rotate it when the process is untrusted.
Connect Cloudflare to Gazebo
Give your agents scoped access to Cloudflare in minutes. Every call logged. Revoke anytime.
Connect CloudflareAgents that commonly use Cloudflare
Further reading
Zero Trust for AI Agents: What It Means and How to Apply It
Zero trust means every credential request is verified, scoped, and logged — regardless of where the agent runs. Here's what the four core primitives look like in practice.
Using Gazebo with Doppler: Adding AI Agent Access Controls to Your Secrets Setup
Doppler handles secret storage and environment sync. Gazebo adds per-agent identity, approval gates, and action-level audit logs on top. Here's how to layer them without changing your existing Doppler setup.
Why Environment Variables Are Insecure for AI Agents
Environment variables feel like a secure way to pass credentials to AI agents. They're not. Here's why the process environment is a shared bus, not a secrets store — and what to do instead.
IAM for AI Agents: Identity Architecture for Autonomous Systems
The identity architecture for autonomous agents: scoped profiles, brokered credentials, approval gates, and lifecycle controls beyond human IAM.
What Is a Secrets Broker for AI Agents?
A secrets manager stores your credentials. A secrets broker controls which AI agent can retrieve them, under what conditions, and what it can do with them. Here's why the distinction matters.
Why AI Agents Shouldn't Share API Keys
The blast radius problem with shared credentials — and how to apply least privilege to every AI agent you run.