Cloudflare Fundamentals

The Cloudflare Tunnel - Granular Connector cloudflared Read And Monitor role is now generally available. You can grant a member read access and log streaming for specific Cloudflare Tunnel instances without granting write access or access to every Tunnel in your account. This role includes the same access as Cloudflare Tunnel - Granular Connector cloudflared Read: viewing selected Tunnels, their…

Cloudflare has improved how it handles and reports client-cancelled HTTP/3 requests across Free, Pro, Business, and Enterprise plans. Customers now get a clearer view of client behavior in Cloudflare analytics and, where available, logs. Previously, Cloudflare did not always stop an HTTP/3 request when the client cancelled its request stream. Some cancellations were already recorded as 499, while…

Markdown for Agents now converts HTML with an in-process streaming engine at the edge. It processes content as it arrives instead of buffering the HTML response and sending it to a separate conversion service. This reduces conversion overhead and memory use. This release also changes the conversion limit and response headers: Conversion supports up to 6 MiB (6,291,456 bytes) of decompressed HTML,…

Cloudflare Organizations is now generally available for Enterprise customers and MSSP/Distributor partners. Organizations provides a top-level container for centrally managing accounts, members, analytics, and shared policies. Organization Super Administrators receive implicit access to every account in their Organization without requiring separate account memberships. Enterprise customers can ma…

Cloudflare Organizations now support up to 20,000 accounts and 200,000 zones. For MSSP/Distributors using sub-organizations, these limits are applied at the root Organization. If you require a higher limit, reach out to your account team. The new limits apply to enterprise and MSSP/Distributor Organizations. Legacy reseller partner and brand partner tenants retain their existing quota behavior. F…

Cloudflare organizations help administrators manage multiple accounts from a single pane of glass with analytics, shared configurations, audit logs, and org super administrators. Organizations is currently in beta for Enterprise accounts. Now when you create an organization, you will see a helpful checklist of the tasks to complete as part of configuring a new organization. This checklist can be…

Account API token creation is no longer limited to Super Administrators. Members with the API Token Provisioning role can now create Account API tokens via the Dashboard, API, Terraform, or CF CLI, making it easier for developers and platform teams to provision credentials without depending on a Super Administrator for Account API Token Provisioning. What's new Delegated creation: Members with th…

We're expanding how customers create accounts across Cloudflare, making it easier to self-serve account creation in the dashboard, automate standalone account creation with user-owned API tokens or OAuth access tokens, and create Free accounts directly within Enterprise Organizations. What's New Dashboard account creation: All cloudflare customers can create additional Free accounts directly thro…

Enterprise customers can now configure a zone's CDN Maximum Upload Size up to 5 GB directly from the Network page in the Cloudflare dashboard. This removes the need to contact your account team or Cloudflare Support when applications need to accept request bodies larger than 500 MB and no greater than 5 GB. The default maximum upload size remains 500 MB. Upload limits above 5 GB still require add…

Cloudflare API 403 Forbidden responses now include a documentation_url field that links directly to the API documentation for the endpoint that was denied. This gives developers, administrators, and agents an immediate path to the relevant docs with role information instead of guessing at which role or permission they are missing for that endpoint. What's New Enriched 403 error responses: When a…

Cloudflare Dashboard users can now save login profiles on a device for faster sign-in on future visits. What's New Save login profiles on a device: After a successful sign-in, users can choose to save a login profile on that device. Saved profiles store the email address, login method, and last-used profile locally in the browser. Faster sign-in for returning users: Saved profiles appear directly…

Dashboard SCIM now supports replacing groups using HTTP PUT, as defined by RFC 7644 section 3.5.1 ↗︎. This allows identity providers to synchronize a group's full state, including its display name, external ID, and members, in a single request. What's New Group replacement via PUT: Full-state group synchronization improves compatibility with identity providers that use replacement semantics and h…

We're announcing the GA of Optional OAuth Scopes. OAuth client developers can now classify configured scopes as required or optional in the Cloudflare dashboard. By default, all configured scopes remain required . What's New Optional Scopes: OAuth clients can now mark configured scopes as optional, allowing applications to request them without requiring users to approve them. Scope Selection: On…

Members with only resource-scoped Access roles can now open Access resource list pages in the Cloudflare dashboard and call list endpoints in the API. They no longer need an additional account-scoped read-only role to list resources. The dashboard and API return only resources included in the member's permission policy scopes. Filtering applies to Access applications, policies, service tokens, an…

OAuth consent screens now display a shield icon with explanatory text beneath the consent screen title. Each shield icon indicates who owns the application and whether its domain ownership is verified. Green filled shield: Cloudflare owns and manages the application. Blue outlined shield: A third-party application with verified ownership of its domain. Amber filled shield: A third-party applicati…

You can now create standalone Free accounts directly from the Cloudflare dashboard using the new Create Account button. This feature is currently available to all users. When creating a Free account: You can create up to 5 Free accounts. Your user account must have at least 7 days of tenure to be eligible. The account is created immediately and ready to use. To create a Free account, go to the Cl…

The Account Roles API is deprecated and is being replaced by the Permission Groups API. An end of life date has not yet been established. What you need to do Review the Permission Groups API documentation; the response schema differs from the legacy Roles response. Highlights Integrations migrating to the Permission Groups API must obtain Permission Group IDs from that API and use them in the Acc…

Distributor, MSSP, and Agency partners on Cloudflare Organizations can now add and manage Organization Members directly from the Cloudflare dashboard, without help from Cloudflare. Previously, adding a member to a Distributor, MSSP, or Agency Organization was a manual, Cloudflare-assisted process that required a request to Cloudflare and enrollment in a closed beta, and the dashboard Add member f…

Markdown for Agents now preserves security- and cache-relevant response headers from your origin when converting HTML to Markdown: Markdown for Agents preserves security headers such as Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, Set-Cookie, and CORS headers (for example, Access-Control-Allow-Origin) on the converted response. Caching headers (Cache-Control,…

You can now assign granular, resource-scoped roles for Cloudflare Gateway firewall policies and Zero Trust lists. Administrators can delegate access to specific policy types or list management without granting account-wide or product-wide control. What is new When you add a member or create a permission policy, the following resource-scoped roles are now available: Role Description Zero Trust Gat…

You can now search API tokens by name, making it easier to find specific tokens across large token lists without manually paginating. What's new Dashboard search: Both account API tokens ↗︎ and user API tokens ↗︎ pages now include a search bar. Type a name to filter results. API search support: The /user/tokens and /accounts/{account_id}/tokens endpoints now accept a name query parameter to filte…

Pay-as-you-go customers can now view billable usage and create budget alerts directly from the product overview pages for Workers & Pages, D1, R2, Workers KV, Queues, Vectorize, Durable Objects, and Containers. A new sidebar widget shows current-period spend and the billing cycle date range, alongside a button to create a budget alert. The widget pulls from the same data as the Billable Usage das…

Today we are launching self-managed OAuth, enabling developers to build third-party applications that integrate with Cloudflare via OAuth. This provides a more secure, user-friendly, and manageable alternative to API tokens. OAuth lets third-party applications act on behalf of a user to access their Cloudflare account. For example, after a user grants consent, Wrangler can deploy Workers into tha…

You can now scope Cloudflare permissions to individual Cloudflare Tunnel instances and Cloudflare Mesh nodes. Administrators can delegate access to specific Tunnels or Mesh nodes without granting account-wide control over private networking. What is new When you add a member or create a permission policy, the resource picker now lists Cloudflare Tunnel instances and Cloudflare Mesh nodes as scopa…

You can now navigate, switch context, and take common actions in the Cloudflare dashboard without leaving your keyboard. Press ? anywhere to see the full list. Keyboard shortcuts can be disabled by visiting your profile settings ↗︎. Navigate Shortcut Action g h Go to Home g a Go to account overview g z Go to zone overview g p Go to your profile g w Go to Workers & Pages g o Go to Zero Trust g b G…

You can now pay for Cloudflare services directly from your bank account using Instant Bank Payments via Link. What changed Link ↗︎ now supports bank account payments in addition to cards. If you have a bank account saved in Link, it appears as a payment option at checkout. If not, you can connect one during the checkout flow. How to use it During checkout, select your bank account from your saved…

Cloudflare-generated 5xx error responses now return structured JSON and Markdown when agents request them, matching the format already available for 1xxx errors. Responses follow RFC 9457 (Problem Details for HTTP APIs) ↗︎ and include a Retry-After HTTP header on retryable codes. Changes 5xx coverage. Ten Cloudflare-generated error codes (500, 502, 504, 520-526) now serve structured responses. Th…

Resource Tagging is now in public beta and rolling out to all Cloudflare accounts over the coming days. You can attach custom key-value metadata to your Cloudflare resources and query across your entire account to find what you need. What's included Broad resource type support — Tag zones, custom hostnames, Cloudflare Tunnels, Workers, D1 databases, R2 buckets, KV namespaces, Durable Object names…

A new Network Overview page in the Cloudflare dashboard gives you a single starting point for network security and connectivity products. From the Network Overview page, you can: Connect resources with Cloudflare Tunnel - Create tunnels to connect your infrastructure to Cloudflare without exposing it to the public Internet. Monitor traffic with Network Flow - Get real-time visibility into traffic…

Pay-as-you-go customers can now monitor usage-based costs and configure spend alerts through two new features: the Billable Usage dashboard and Budget alerts. Billable Usage dashboard The Billable Usage dashboard provides daily visibility into usage-based costs across your Cloudflare account. The data comes from the same system that generates your monthly invoice, so the figures match your bill.…

OAuth allows third-party applications to access your Cloudflare account on your behalf — like when Wrangler deploys Workers or when monitoring tools read your analytics. You now have granular control over which accounts these applications can access, plus the ability to revoke access anytime. What's new Choose which accounts to authorize When authorizing an OAuth application, you can now select s…

Cloudflare API tokens now include identifiable patterns that enable secret scanning tools to automatically detect them when leaked in code repositories, configuration files, or other public locations. What changed API tokens generated by Cloudflare now follow a standardized format that secret scanning tools can recognize. When a Cloudflare token is accidentally committed to GitHub, GitLab, or ano…

We're announcing the public beta of Organizations for enterprise customers, a new top-level Cloudflare container that lets Cloudflare customers manage multiple accounts, members, analytics, and shared policies from one centralized location. What's New Organizations [BETA]: Organizations are a new top-level container for centrally managing multiple accounts. Each Organization supports up to 500 ac…

Service Key authentication for the Cloudflare API is deprecated. Service Keys will stop working on September 30, 2026. API Tokens replace Service Keys with fine-grained permissions, expiration, and revocation. What you need to do Replace any use of the X-Auth-User-Service-Key header with an API Token scoped to the permissions your integration requires. If you use cloudflared, update to a version…

Cloudflare dashboard SCIM provisioning now supports Authentik ↗︎ as an identity provider, joining Okta and Microsoft Entra ID as explicitly supported providers. Customers can now sync users and group information from Authentik to Cloudflare, apply Permission Policies to those groups, and manage the lifecycle of users & groups directly from your Authentik Identity Provider. Note SCIM provisioning…

Cloudflare dashboard SCIM provisioning operations are now captured in Audit Logs v2, giving you visibility into user and group changes made by your identity provider. Logged actions: Action Type Description Create SCIM User User provisioned from IdP Replace SCIM User User fully replaced (PUT) Update SCIM User User attributes modified (PATCH) Delete SCIM User Member deprovisioned Create SCIM Group…

Cloudflare-generated 1xxx error responses now include a standard Retry-After HTTP header when the error is retryable. Agents and HTTP clients can read the recommended wait time from response headers alone — no body parsing required. Changes Seven retryable error codes now emit Retry-After: Error code Retry-After (seconds) Error name 1004 120 DNS resolution error 1005 120 Banned zone 1015 30 Rate…

Cloudflare-generated 1xxx errors now return structured JSON when clients send Accept: application/json or Accept: application/problem+json. JSON responses follow RFC 9457 (Problem Details for HTTP APIs) ↗︎, so any HTTP client that understands Problem Details can parse the base members without Cloudflare-specific code. Breaking change The Markdown frontmatter field http_status has been renamed to…

Cloudflare now returns structured Markdown responses for Cloudflare-generated 1xxx errors when clients send Accept: text/markdown. Each response includes YAML frontmatter plus guidance sections (What happened / What you should do) so agents can make deterministic retry and escalation decisions without parsing HTML. In measured 1,015 comparisons, Markdown reduced payload size and token footprint b…

When AI systems request pages from any website that uses Cloudflare and has Markdown for Agents enabled, they can express the preference for text/markdown in the request: our network will automatically and efficiently convert the HTML to markdown, when possible, on the fly. This release adds the following improvements: The origin response limit was raised from 1 MB to 2 MB (2,097,152 bytes). We n…

Fine-grained permissions for Access policies and Access service tokens are available. These new resource-scoped roles expand the existing RBAC model, enabling administrators to grant permissions scoped to individual resources. New roles Cloudflare Access policy admin: Can edit a specific Access policy in an account. Cloudflare Access service token admin: Can edit a specific Access service token i…

Disclaimer: Please note that v5.0.0-beta.1 is in Beta and we are still testing it for stability. Full Changelog: v4.3.1...v5.0.0-beta.1 ↗︎ In this release, you'll see a large number of breaking changes. This is primarily due to a change in OpenAPI definitions, which our libraries are based off of, and codegen updates that we rely on to read those OpenAPI definitions and produce our SDK libraries.…

Cloudflare's network now supports real-time content conversion at the source, for enabled zones using content negotiation ↗︎ headers. When AI systems request pages from any website that uses Cloudflare and has Markdown for Agents enabled, they can express the preference for text/markdown in the request: our network will automatically and efficiently convert the HTML to markdown, when possible, on…

In January 2025, we announced the launch of the new Terraform v5 Provider. We greatly appreciate the proactive engagement and valuable feedback from the Cloudflare community following the v5 release. In response, we have established a consistent and rapid 2-3 week cadence ↗︎ for releasing targeted improvements, demonstrating our commitment to stability and reliability. With the help of the commun…

You can now set the timezone in the Cloudflare dashboard as Coordinated Universal Time (UTC) or your browser or system's timezone. What's New Unless otherwise specified in the user interface, all dates and times in the Cloudflare dashboard are now displayed in the selected timezone. You can change the timezone setting from the user profile dropdown. The page will reload to apply the new timezone…

In an effort to improve overall user security, users without 2FA will be prompted upon login to enroll in email 2FA. This will improve user security posture while minimizing friction. Users without email 2FA enabled will see a prompt to secure their account with additional factors upon logging in. Enrolling in 2FA remains optional, but strongly encouraged as it is the best way to prevent account…

Disclaimer: Please note that v6.0.0-beta.1 is in Beta and we are still testing it for stability. Full Changelog: v5.2.0...v6.0.0-beta.1 ↗︎ In this release, you'll see a large number of breaking changes. This is primarily due to a change in OpenAPI definitions, which our libraries are based off of, and codegen updates that we rely on to read those OpenAPI definitions and produce our SDK libraries.…

In January 2025, we announced the launch of the new Terraform v5 Provider. We greatly appreciate the proactive engagement and valuable feedback from the Cloudflare community following the v5 release. In response, we've established a consistent and rapid 2-3 week cadence ↗︎ for releasing targeted improvements, demonstrating our commitment to stability and reliability. With the help of the communit…

Enhanced HTTP/3 request cancellation visibility Cloudflare now provides more accurate visibility into HTTP/3 client request cancellations, giving you better insight into real client behavior and reducing unnecessary load on your origins. Previously, when an HTTP/3 client cancelled a request, the cancellation was not always actioned immediately. This meant requests could continue through the CDN —…

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence ↗︎ to ensure its stability and reliability, including the v5.15 release. We have also pivoted from an issue-to-issue approach to a resource-per-resour…

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence ↗︎ to ensure its stability and reliability, including the v5.14 release. We have also pivoted from an issue-to-issue approach to a resource-per-resour…

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2-3 week cadence ↗︎ to ensure its stability and reliability, including the v5.13 release. We have also pivoted from an issue-to-issue approach to a resource-per-resour…

Two-factor authentication (2FA) is one of the best ways to protect your account from the risk of account takeover. Cloudflare has offered phishing resistant 2FA options including hardware based keys (for example, a Yubikey) and app based TOTP (time-based one-time password) options which use apps like Google or Microsoft's Authenticator app. Unfortunately, while these solutions are very secure, th…

As Cloudflare's platform has grown, so has the need for precise, role-based access control. We’ve redesigned the Member Management experience in the Dashboard to help administrators more easily discover, assign, and refine permissions for specific principals. What's New Refreshed member invite flow We overhauled the Invite Members UI to simplify inviting users and assigning permissions. Refreshed…

CDN now supports 128 KB request and response headers 🚀 We're excited to announce a significant increase in the maximum header size supported by Cloudflare's Content Delivery Network (CDN). Cloudflare now supports up to 128 KB for both request and response headers. Previously, customers were limited to a total of 32 KB for request or response headers, with a maximum of 16 KB per individual header…

During Birthday Week, we announced that single sign-on (SSO) is available for free ↗︎ to everyone who signs in with a custom email domain and maintains a compatible identity provider ↗︎. SSO minimizes user friction around login and provides the strongest security posture available. At the time, this could only be configured using the API. Today, we are launching a new user experience which allows…

The most common reason users contact Cloudflare support is lost two-factor authentication (2FA) credentials. Cloudflare supports both app-based and hardware keys for 2FA, but you could lose access to your account if you lose these. Over the past few weeks, we have been rolling out email and in-product reminders that remind you to also download backup codes (sometimes called recovery keys) that ca…

Fine-grained permissions for Access Applications, Identity Providers (IdPs), and Targets is now available in Public Beta. This expands our RBAC model beyond account & zone-scoped roles, enabling administrators to grant permissions scoped to individual resources. What's New Access Applications ↗︎: Grant admin permissions to specific Access Applications. Identity Providers ↗︎: Grant admin permissio…

Users can now specify that they want to retrieve Cloudflare documentation as markdown rather than the previous HTML default. This can significantly reduce token consumption when used alongside Large Language Model (LLM) tools. curl https://developers.cloudflare.com/workers/ -H 'Accept: text/markdown' -v If you maintain your own site and want to adopt this practice using Cloudflare Workers for you…

Cloudflare has launched sign in with GitHub as a log in option. This feature is available to all users with a verified email address who are not using SSO. To use it, simply click on the Sign in with GitHub button on the dashboard login page. You will be logged in with your primary GitHub email address. For more information Log in to Cloudflare

Single sign-on (SSO) streamlines the process of logging into Cloudflare for Enterprise customers who manage a custom email domain and manage their own identity provider. Instead of managing a password and two-factor authentication credentials directly for Cloudflare, SSO lets you reuse your existing login infrastructure to seamlessly log in. SSO also provides additional security opportunities suc…

Two-factor authentication is the best way to help protect your account from account takeovers, but if you lose your second factor, you could be locked out of your account. Lock outs are one of the top reasons customers contact Cloudflare support, and our policies often don't allow us to bypass two-factor authentication for customers that are locked out. Today we are releasing an improvement where…

Cloudflare's API now supports rate limiting headers using the pattern developed by the IETF draft on rate limiting ↗︎. This allows API consumers to know how many more calls are left until the rate limit is reached, as well as how long you will need to wait until more capacity is available. Our SDKs automatically work with these new headers, backing off when rate limits are approached. There is no…

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues ↗︎ reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2 week cadence to ensure its stability and reliability, including the v5.9 release. We have also pivoted from an issue-to-issue approach to a resource-per-resource…

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues ↗︎ reported by the Cloudflare Community related to the v5 release. We have committed to releasing improvements on a two week cadence to ensure stability and reliability. One key change we adopted in recent weeks is a pivot to more comprehensive, test-driven development. We are st…

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues ↗︎ reported by the Cloudflare community related to the v5 release. We have committed to releasing improvements on a 2 week cadeance to ensure it's stability and reliability. We have also pivoted from an issue-to-issue approach to a resource-per-resource approach - we will be focu…

Earlier this year, we announced the launch of the new Terraform v5 Provider. We are aware of the high number of issues ↗︎ reported by the Cloudflare community related to the v5 release, with 13.5% of resources impacted. We have committed to releasing improvements on a 2 week cadeance to ensure it's stability and relability, including the v5.7 release. Thank you for continuing to raise issues and…

We're announcing the GA of User Groups for Cloudflare Dashboard and System for Cross Domain Identity Management (SCIM) User Groups, strengthening our RBAC capabilities with stable, production-ready primitives for managing access at scale. What's New User Groups [GA]: User Groups are a new Cloudflare IAM primitive that enable administrators to create collections of account members that are treated…

Earlier this year, we announced the launch of the new Terraform v5 Provider. Unlike the earlier Terraform providers, v5 is automatically generated based on the OpenAPI Schemas for our REST APIs. Since launch, we have seen an unexpectedly high number of issues ↗︎ reported by customers. These issues currently impact about 15% of resources. We have been working diligently to address these issues acr…

We're excited to announce the Public Beta launch of User Groups for Cloudflare Dashboard and System for Cross Domain Identity Management (SCIM) User Groups, expanding our RBAC capabilities to simplify user and group management at scale. We've also visually overhauled the Permission Policies UI to make defining permissions more intuitive. What's New User Groups [BETA]: User Groups are a new Cloudf…

Earlier this year, we announced the launch of the new Terraform v5 Provider. Unlike the earlier Terraform providers, v5 is automatically generated based on the OpenAPI Schemas for our REST APIs. Since launch, we have seen an unexpectedly high number of issues ↗︎ reported by customers. These issues currently impact about 15% of resources. We have been working diligently to address these issues acr…

Earlier this year, we announced the launch of the new Terraform v5 Provider. Unlike the earlier Terraform providers, v5 is automatically generated based on the OpenAPI Schemas for our REST APIs. Since launch, we have seen an unexpectedly high number of issues ↗︎ reported by customers. These issues currently impact about 15% of resources. We have been working diligently to address these issues acr…

Recently, Account Home has been updated to streamline your workflows: Recent Workers projects: You'll now find your projects readily accessible from a new Developer Platform tab on Account Home. See recently-modified projects and explore what you can work our developer-focused products. Traffic and security insights: Get a snapshot of domain performance at a glance with key metrics and trends. Qu…

In Cloudflare Terraform Provider ↗︎ versions 5.2.0 and above, dozens of resources now have proper drift detection. Before this fix, these resources would indicate they needed to be updated or replaced — even if there was no real change. Now, you can rely on your terraform plan to only show what resources are expected to change. This issue affected resources ↗︎ related to these products and featur…

In the Cloudflare Terraform Provider ↗︎ versions 5.2.0 and above, sensitive properties of resources are redacted in logs. Sensitive properties in Cloudflare's OpenAPI Schema ↗︎ are now annotated with x-sensitive: true. This results in proper auto-generation of the corresponding Terraform resources, and prevents sensitive values from being shown when you run Terraform commands. This issue affected…

Cloudflare's v5 Terraform Provider is now generally available. With this release, Terraform resources are now automatically generated based on OpenAPI Schemas. This change brings alignment across our SDKs, API documentation, and now Terraform Provider. The new provider boosts coverage by increasing support for API properties to 100%, adding 25% more resources, and more than 200 additional data so…