Connect a Cloudflare domain

Setup type: One-click (OAuth). You sign in to Cloudflare in a popup and approve the change. No records to copy; no password is shared with the app.

Cloudflare is the smoothest case: it supports native OAuth, so your users click, sign in to Cloudflare, approve, and the records are written for them, no copy-paste. Cloudflare also implements the Domain Connect standard, but the OAuth rail is preferred because it maps to Cloudflare's own permission model.

What you'll need

• A domain whose DNS is managed at Cloudflare.
• Access to your app's CustomDomain dashboard (it shows the exact target for your account).

The records

CustomDomain gives you the authoritative records for your account in the dashboard, typically a CNAME (or apex A/ALIAS) pointing your domain at the edge. Use the values shown there; the shape is always the same, the target is per-account. There is no separate ownership TXT to add on this path: control is proven by the rail itself, or by the records appearing in your own authoritative DNS. See Setup types.

Setting it up on Cloudflare

1. In the connect widget, choose Cloudflare and click connect.
2. A Cloudflare sign-in window opens. Approve the requested DNS change.
3. The records apply automatically; you're returned to the app, which verifies and goes live.

Cloudflare specifics

• The OAuth token requests only dns.write and zone.read, the minimum to add the records, nothing more. Cloudflare's API requires the dotted resource.action scope form; the colon form (dns_records:write) is rejected as an invalid scope.
• Cloudflare is on the canonical Domain Connect provider list, so the one-click path works even if the OAuth app is unavailable.
• DC sync also live per the canonical DC list; OAuth preferred.

How you know it worked

CustomDomain polls public DNS and issues the TLS certificate automatically. When the dashboard shows the domain live, HTTPS is serving. Drift monitoring then watches the records so a later change at the provider doesn't silently break the domain.

FAQ

Do I have to hand over my Cloudflare API key?

No. The OAuth flow signs you in to Cloudflare directly and asks only for permission to add DNS records. CustomDomain never sees your Cloudflare password or a global API key.

Will this touch my other Cloudflare DNS records?

No. The token is scoped to write DNS records for the zone you're connecting; it can't read or change anything outside that.

Related

• All DNS providers, the full connection catalog.
• How custom domains work