Skip to main content
Added in: 5.17.0 Prowler for Cloudflare supports two authentication methods, both available in Prowler Cloud and Prowler CLI:
  • API Token (Recommended) — Scoped, least-privilege access to specific permissions and zones.
  • API Key and Email (Legacy) — Global access to the entire account using the Global API Key.
Use only one authentication method at a time. If both API Token and API Key + Email are set, Prowler uses the API Token and logs an error about the conflict.

​
Required Permissions

Prowler requires read-only access to Cloudflare accounts, zones, and developer platform resources. The following permissions must be configured when creating the API Token:
Ensure the API Token has access to all zones targeted for scanning. Missing permissions may cause some checks to fail or return incomplete results.
Account-owned API tokens can only be listed by tokens created by a Super Administrator. When a permission is missing, the affected checks report one MANUAL finding per account naming the missing permission, and the rest of the scan continues. User-owned tokens are still evaluated when the optional API Tokens Read user permission is granted.
User API Tokens are the recommended authentication method because they:
  • Can be scoped to specific permissions and zones
  • Are more secure than global API keys
  • Can be easily rotated without affecting other integrations
Create a User API Token, not an Account API Token. User API Tokens are created from the profile settings and offer finer permission control.
Quick Setup: Use these pre-configured links to open the Cloudflare Dashboard with most of the required permissions already selected. Add the Account API Tokens, Workers Scripts, and Workers R2 Storage read permissions manually before creating the token:
  • Create User API Token — creates a User API Token (recommended). Opens the Create Custom Token form prefilled with the seven required read-only scopes (Account Settings, Zone, Zone Settings, DNS, SSL and Certificates, Bot Management, Zone WAF) and the name Prowler Security Scanner. Then add the Account API Tokens, Workers Scripts, and Workers R2 Storage read permissions (and optionally the user API Tokens read permission) manually. Adjust Account Resources and Zone Resources to match the accounts and zones you want to scan, then click Create Token.
  • Create Account-Owned API Token — creates an account-owned token instead. Use this for automation or CI/CD where the token should not depend on a specific user account remaining active. Requires the Super Administrator or Administrator role on the account. As with the user token link, add the Account API Tokens, Workers Scripts, and Workers R2 Storage read permissions manually.
Template URLs only pre-fill the token creation form. Review the permissions, configure resources, and click Create Token to complete the process.

​
Step 1: Create a User API Token

  1. Log into the Cloudflare Dashboard.
  2. Click the profile icon in the top right corner, then select “My Profile”.
  3. Click the API Tokens tab.
  4. Click Create Token, then select Create Custom Token at the bottom of the page.
  5. Configure the token with the following settings:
    • Token name: A descriptive name (e.g., “Prowler Security Scanner”)
    • Permissions:
      • Account — Account Settings — Read
      • Account — Account API Tokens — Read
      • Account — Workers Scripts — Read
      • Account — Workers R2 Storage — Read
      • User — API Tokens — Read (optional, for user token checks)
      • Zone — Zone — Read
      • Zone — Zone Settings — Read
      • Zone — DNS — Read
      • Zone — SSL and Certificates — Read
      • Zone — Bot Management — Read
      • Zone — Zone WAF — Read
    • Zone Resources: Select either:
      • Include → All zones (to scan all zones in the account)
      • Include → Specific zone (to limit access to specific zones)
    Token Permissions
  6. Configure the Account Resources and Zone Resources, and optionally set a TTL for the token expiration. Click Continue to summary. Token Resources and TTL
  7. Review the permissions and click Create Token.
  8. Copy the token immediately.
Cloudflare only displays the token once. Copy it immediately and store it securely. If lost, a new token must be created.

​
Step 2: Provide the Token to Prowler

  • Prowler Cloud: Paste the token in the credentials form when configuring the Cloudflare provider.
  • Prowler CLI: Export the token as an environment variable:

​
API Key and Email (Legacy)

API Keys provide full access to the Cloudflare account. While supported, this method is less secure than API Tokens because it grants broader permissions.

​
Step 1: Get the Global API Key

  1. Log into the Cloudflare Dashboard.
  2. Click the profile icon in the top right corner, then select “My Profile”.
  3. Click the API Tokens tab.
  4. Scroll down to the API Keys section.
  5. Click View next to Global API Key.
  6. Enter the account password to reveal the key, then copy it.

​
Step 2: Provide the Credentials to Prowler

  • Prowler Cloud: Enter the Global API Key and email in the credentials form when configuring the Cloudflare provider.
  • Prowler CLI: Export both values as environment variables:
The email must match the email address used to log into the Cloudflare account.

​
Best Practices

  • Use API Tokens instead of API Keys — Tokens can be scoped to specific permissions and zones.
  • Use environment variables — Never hardcode credentials in scripts or commands.
  • Rotate credentials regularly — Create new tokens periodically and revoke old ones.
  • Use least privilege — Only grant the minimum permissions needed for scanning.
  • Monitor token usage — Review the Cloudflare audit log for suspicious activity.

​
Troubleshooting

​
”Missing X-Auth-Email header” Error

This error occurs when using API Key authentication without providing the email address. Ensure both CLOUDFLARE_API_KEY and CLOUDFLARE_API_EMAIL are set.

​
”Authentication error” or “Permission denied”

  • Verify the API Token or API Key is correct and not expired.
  • Check that the token has the required permissions.
  • Ensure the token has access to the zones targeted for scanning.

​
”Both API Token and API Key and Email credentials are set”

This warning appears when all three environment variables are set (CLOUDFLARE_API_TOKEN, CLOUDFLARE_API_KEY, CLOUDFLARE_API_EMAIL). To resolve, unset the credentials that are not needed:

​
“Account not found” Error

This error occurs when a specified --account-id is not accessible with the current credentials. Verify the Account ID is correct and that the credentials have access to the target account.