--- title: "Cloudflare Integration" description: "Manage Cloudflare zones, DNS records, cache, security rulesets, and Workers KV storage from your flows over the Cloudflare API v4." url: https://flowrunner.ai/integrations/cloudflare date_modified: 2026-08-01T02:40:32-07:00 --- # Cloudflare [Developer Tools](https://flowrunner.ai/integrations/category/developer-infrastructure) Manage Cloudflare zones, DNS records, cache, security rulesets, and Workers KV storage from your flows over the Cloudflare API v4. [Verified](https://flowrunner.ai/integrations/verified "What does verified mean?") · 16 actions · API key · available [Cloudflare website](https://cloudflare.com/) · [Platform Documentation](https://developers.cloudflare.com/api/) · Capability data verified 2026-07-14 1. A deploy flow finishes shipping a new build 2. Agent resolves the zone for the affected site 3. Agent calls Purge Cache to clear the edge for the changed paths 4. Agent confirms the purge succeeded before signaling downstream steps 5. Agent posts the release and the purge result to the team channel 6. An engineer approves any production DNS record change before the agent applies it ## What This Integration Enables FlowRunner agents use Cloudflare to keep the edge in step with deploys and configuration changes. An agent can create, update, or delete DNS records when infrastructure changes, purge cache after a deployment by everything or by file, tag, host, or prefix, and list and inspect a zone's rulesets to audit managed WAF and custom firewall rules. It can read and write Workers KV values to drive edge configuration or feature flags, and look up zones and records dynamically for other flow steps. Authoring WAF rules and analytics are out of scope by design. What it does not do on its own is change a production DNS record. That change waits for a human, because a bad record can take a domain down. ### Without FlowRunner **Stale edge cache**: Visitors see the old build until someone purges cache by hand **Risky DNS edits**: A production DNS change is applied straight into the dashboard under pressure **Manual flag flips**: An edge feature flag is toggled by opening the KV UI ### With FlowRunner **Cache purged on deploy**: The agent clears the edge as part of the release flow **Approved DNS changes**: Production DNS edits wait for an engineer to approve **Flag flips in-flow**: The agent writes edge feature flags from the workflow ## Use Case Scenarios ### Cache purge on release A deploy flow finishes and calls Netlify to ship the build. The agent then calls Purge Cache on the affected zone so visitors immediately see the new build, confirms the purge, and posts the release and purge result to the team channel. The edge stays in step with the deploy without anyone touching the dashboard. ### Preview subdomains for pull requests When a preview environment comes up for a pull request, the agent calls Create DNS Record to point a preview subdomain at the deploy and shares the preview URL with reviewers. Because a preview record is low-stakes, the agent creates it on its own. Reviewers get a working link without waiting on an infra ticket. ### Production DNS change gate An infrastructure change requires a production DNS record update. The agent reads the current record with Get DNS Record, drafts the proposed change, and posts both to the infrastructure channel. It does not apply the change. Only after an engineer approves does the agent call Update DNS Record, and it records the before and after values in the flow log. ## Human-in-Loop Highlight The human-in-loop moment in Cloudflare is the production DNS gate. Purging cache, reading rulesets, and writing preview records or KV values are reversible or low-stakes, so the agent runs them by rule. Changing a production DNS record is not, because a wrong value can take a domain offline and propagation makes it slow to walk back. When a flow needs a production record change, the agent reads the current record, drafts the new one, and posts both to the infrastructure channel: "Proposed change to the A record for app.example.com: 203.0.113.10 becomes 203.0.113.42. Approve?" An engineer approves. Only then does the agent call Update DNS Record. The agent keeps the edge current. A person owns the record that points the domain. Agent processes routinely Detects exception requiring judgment Clear match Continues automatically Ambiguous Routes to human via preferred channel Human decides Agent resumes with decision ## Agent Capabilities 16 actions ### Zones 2 - **List Zones** List the zones in the account. - **Get Zone** Retrieve a single zone by ID. ### Cache 1 - **Purge Cache** Purge the edge cache for a zone, either everything or by file, tag, host, or prefix. Used after a deploy so visitors see the new build. ### DNS 6 - **List DNS Records** List the DNS records in a zone. - **Create DNS Record** Create a DNS record in a zone. Used to point a preview subdomain at a deploy. - **Get DNS Record** Retrieve a single DNS record. Used to read the current value before a change. - **Update DNS Record** Replace a DNS record's content and settings. Run it behind a human approval on production records. - **Patch DNS Record** Partially update a DNS record. - **Delete DNS Record** Delete a DNS record. ### Security Rulesets 2 - **List Rulesets** List a zone's rulesets. Used to audit managed WAF and custom firewall rules. - **Get Ruleset** Retrieve a single ruleset and its rules. ### Workers KV 5 - **List KV Namespaces** List the Workers KV namespaces in the account. Requires an Account ID. - **List KV Keys** List the keys in a Workers KV namespace. - **Get KV Value** Read a value from a Workers KV namespace. Used to read edge configuration or a feature flag. - **Put KV Value** Write a value into a Workers KV namespace. Used to update an edge feature flag or version key. - **Delete KV Value** Delete a key from a Workers KV namespace. ## Frequently Asked Questions ### What can FlowRunner do with Cloudflare? FlowRunner agents can run List Zones, Get Zone, and Purge Cache in Cloudflare, plus 13 more actions. ### Does connecting Cloudflare to FlowRunner require OAuth? No. Cloudflare connects to FlowRunner with an API key, no OAuth flow required. ### Can Cloudflare trigger a FlowRunner workflow automatically? Cloudflare doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger. **Work at Cloudflare?** This integration exposes Cloudflare to AI agents on every FlowRunner plan, including through MCP, at no cost to you. [See what FlowRunner offers integration partners](https://flowrunner.ai/integrations/partners), including how to keep this page current. --- Markdown version of https://flowrunner.ai/integrations/cloudflare. Site index: https://flowrunner.ai/llms.txt