# Cloudflare

Probo reads your Cloudflare account's members through the Cloudflare API so you can review who has access.

:::caution
Use a scoped **API Token** (newly created tokens are prefixed `cfut_`) created in the Cloudflare dashboard under **My Profile** > **API Tokens**. A **Global API Key** will **not** work, because it authenticates with `X-Auth-Email` and `X-Auth-Key` headers instead of the `Authorization: Bearer` scheme Probo uses.
:::

## Prerequisites

- Probo organization administrator access
- Membership in the Cloudflare account you want to review, with privileges to grant account-level read permissions (**Super Administrator - All Privileges** is sufficient; an account **Administrator** also works)
- The token scoped to include every account whose members should be reviewed (**Account Resources** set to **All accounts** or the specific accounts), since Probo only sees accounts the token is authorized for

## Collected Fields

| Probo field | Cloudflare field                                         | Notes                                                                                            |
| ----------- | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| Name        | `first_name` and `last_name`                             | Combined into the member's display name                                                          |
| Email       | `email`                                                  |                                                                                                  |
| Role        | `roles[].name`                                           | Defaults to Member when the member has no roles                                                  |
| Admin       | `roles[].name`                                           | Flagged as an administrator when a role is Super Administrator - All Privileges or Administrator |
| Status      | `status`                                                 | A member is active when `status` is `accepted`                                                   |
| MFA         | `two_factor_authentication_enabled`                      | Whether two-factor authentication is enabled for the member                                      |
| Last login  |  |                                                                                                  |
| External ID | `id`                                                     | Stable identifier used to track the account across reviews                                       |
| Created at  |  |                                                                                                  |

## Step 1: Create an API Token

1. In the [Cloudflare dashboard](https://dash.cloudflare.com/profile/api-tokens), go to **My Profile** > **API Tokens** > **Create Token**, then choose **Get started** under **Custom token**.
2. Name it (e.g. `Probo Access Review`), add the permission **Account** > **Account Settings** > **Read**, and set **Account Resources** to **Include** > **All accounts** (or the specific accounts to review). Read access is enough, since Probo only issues read requests.
3. Create the token, then copy it and store it securely. It's shown only once.

## Step 2: Connect in Probo

1. In Probo, go to **Settings** > **Connectors** and click **Add more** to open the **Marketplace**.
2. Find **Cloudflare** and open it.
3. Enter a **Name** for the connection (e.g. `main`), paste the token into **API key**, and click **Connect**.
4. If the token covers more than one Cloudflare account, open the Cloudflare connector in **Settings** > **Connectors** and choose the account to review in the **Organization** field. When the token covers a single account, Probo selects it.
5. Go to **Access Review** > **Sources**, click **Add sources**, tick **Cloudflare**, and click **Add**.

Probo names the source after the selected Cloudflare account and pulls that account's members into your campaigns.

## Troubleshooting

- **Token rejected.** Confirm it's a scoped API Token with **Account Settings: Read** permission. A Global API Key won't work, because it uses `X-Auth-Email` and `X-Auth-Key` headers instead of `Authorization: Bearer`.
- **Add sources shows "Pick an organization in Settings first."** Probo has no Cloudflare account selected for the connector. Choose one in the **Organization** field of the Cloudflare connector in **Settings** > **Connectors**. If that field lists none, the token's **Account Resources** don't include any account.
- **No members appear.** The token must be scoped to include the account you're reviewing (**Account Resources**), and its creator must be a member of that account with permission to read the account's membership.