cloudflare

alchemy provider cloudflare <subcommand> [options]

Cloud-provider commands for Cloudflare. The state-store Worker that backs Cloudflare.state(...) is managed with alchemy state bootstrap|teardown|logs --backend cloudflare.

provider cloudflare token

alchemy provider cloudflare token [options]

Mint a Cloudflare API token (POST /user/tokens) from the CLI. Useful for creating the CLOUDFLARE_API_TOKEN you hand to CI, or a broad local token for alchemy deploy. You’ll be pointed to your Cloudflare profile once to grab your Global API Key (unless it’s already in the environment); everything else happens in the terminal.

This command is standalone — it takes no --profile and does not use an Alchemy auth profile. Cloudflare only mints a token whose permissions the authenticating credential is allowed to grant, and OAuth/scoped tokens silently produce a token with zero permissions. So this command always authenticates with your account’s Global API Key, read from CLOUDFLARE_API_KEY / CLOUDFLARE_EMAIL (or prompted). The key is used only to create the token and is never stored.

By default you pick permission groups from an interactive multi-select, resolved live from your account — restricted to the three scopes that can actually become a token policy (account, zone, r2). Pass --all-permissions for a “superuser” token spanning every permission group your account exposes (after a confirmation prompt).

◇  Select a Cloudflare account
│  My Account
│
◇  Token name
│  alchemy-superuser
│
◇  Create a superuser token with all permissions?
│  Yes

Created Cloudflare API token "alchemy-superuser" (7cb070fe...).
Granted 360 permission group(s) across 3 policy(ies); token status: active.

cfut_pMtBzTOGHWyFC2RSNvfw8f7p2cc...

Store this value now — Cloudflare only shows it once. Use it as CLOUDFLARE_API_TOKEN.

Option	Description
--all-permissions	Grant every Cloudflare permission group (a “superuser” token). Prompts for confirmation.
--name <name>	Token name. Prompted (required) if omitted.
--account-id <id>	Account ID(s) to scope the token to — comma-separated for multiple. If omitted, you’ll be prompted with a multi-select spanning your accounts.
--env-file <path>	Load environment variables (e.g. CLOUDFLARE_API_KEY, CLOUDFLARE_EMAIL) from a file

The permission groups are resolved live from your account (so the token always uses IDs valid for that account), and the freshly minted token is verified against /user/tokens/verify before the value is printed.

If the result reports Granted 0 permission group(s), the token is useless: a token can only carry permissions the authenticating user already holds, so this usually means the Global API Key’s user is not a Super Administrator on the selected account. Check the user’s role under Members in the Cloudflare dashboard and retry.

Note

The Cloudflare dashboard has a long-standing rendering bug where API-created tokens show a blank permission summary (and a greyed-out “View”) on first load. The permissions are applied regardless — the Granted N permission group(s) line and token status: active confirm it. To see them in the UI, open the token and click “← Edit token”.

# Pick permission groups interactively for a typical Alchemy deploy token
alchemy provider cloudflare token --name ci-token

# Full-access "superuser" token
alchemy provider cloudflare token --all-permissions --name admin

# Non-interactive: key/email from the environment, explicit account
CLOUDFLARE_API_KEY=... CLOUDFLARE_EMAIL=you@example.com \
  alchemy provider cloudflare token --name ci --account-id <account-id>

Where next

• aws — provider commands for AWS
• state — bootstrap, tear down and read the state store
• Inspecting State — read and manage the state store from the CLI
• State Store — where resource state lives
• Cloudflare — the Cloudflare provider hub