Skip to main content

Authentication

All scripts read credentials from a single config file at ~/.cloudflare.

You can define either generic (default) credentials or multiple named profiles. If multiple profiles exist, the scripts offer an interactive menu to choose which profile to use.

What you can define​

  • Generic (fallback) credentials
    • CF_ACCOUNT + CF_KEY (Global API Key auth), or
    • CF_TOKEN (scoped API Token auth)
  • Profile-based credentials (recommended)
    • CF_ACCOUNT_<PROFILE> + CF_KEY_<PROFILE>
    • CF_TOKEN_<PROFILE>

Profiles are any uppercase name you choose (for example PROD, DEV, CLIENT1). The scripts detect every CF_(ACCOUNT|TOKEN|KEY)_<PROFILE> entry and list them for selection.

Precedence (highest to lowest)​

  1. A specific profile passed explicitly with --cf-profile (or --cf-auth-profile).
  2. Interactive choice, when multiple profiles are found.
  3. Generic credentials: CF_TOKEN, or CF_ACCOUNT + CF_KEY.

Examples​

Minimal (generic) credentials:

# Uses a single default set for all scripts
CF_ACCOUNT=example@domain.com
CF_KEY=your_global_api_key
# OR
CF_TOKEN=your_api_token

Multiple profiles (recommended):

# Production
CF_ACCOUNT_PROD=prod@company.com
CF_KEY_PROD=prod_global_api_key
# OR
# CF_TOKEN_PROD=prod_api_token

# Development
CF_TOKEN_DEV=dev_api_token

# Client-specific
CF_ACCOUNT_CLIENT1=client1@theircompany.com
CF_TOKEN_CLIENT1=client1_api_token

Legacy keys (still supported):

# Super Page Cache
CF_ACCOUNT_SPC=spc@company.com
CF_TOKEN_SPC=spc_api_token

# Turnstile
CF_ACCOUNT_TS=turnstile@company.com
CF_TOKEN_TS=turnstile_api_token

The complete commented template lives in .cloudflare.example.

Notes​

  • Token auth is preferred: it is safer and easier to scope (Zone.Firewall Services:Edit, and the newer Rulesets permissions described in Migration to the Rulesets API).
  • Some commands do not require authentication and will run without reading ~/.cloudflare:
    • list-profiles
    • print-profile <profile>
    • validate-profile <profile>
    • list-auth-profiles

Passing a profile to a command​

./cfwr.sh -d domain.com -c create-rules default --cf-profile PROD

The same flag works on cloudflare-token.sh and cloudflare-turnstile.sh.

Using an alternative credentials file​

cfwr.sh forwards --config to whoever it runs, and both cfwrv1.sh and cfwrv2.sh accept it — so either version can read credentials from a file other than ~/.cloudflare:

./cfwr.sh -d domain.com -c list-rules --config ~/.cloudflare-client1

The file has exactly the same format as ~/.cloudflare — profiles, tokens and keys all work unchanged — so this is the way to keep a client's credentials in a separate, separately-protected file.

Three limits are worth knowing:

  • It applies to the WAF rules scripts only. cloudflare-token.sh and cloudflare-turnstile.sh always read ~/.cloudflare.
  • There is no environment variable for it. The flag is the only way to point at another file; a relative path is resolved from the directory you run the command in.