Connecting Cloudflare to Stacktic

For: a Cloudflare account admin, such as a Super Administrator. Takes about 5–10 minutes.

What this integration does

Connecting Cloudflare lets Stacktic see everyone who can use the dashboard for a Cloudflare account. Cloudflare calls these people the account's members. When someone leaves, Stacktic can remove them in one step.

To connect, you create a password for apps in the Cloudflare dashboard, which Cloudflare calls an API token. Stacktic stores it encrypted and only uses it with the one account you connect.

Stacktic needs two values:

Value	What it is
API token	A Cloudflare API token limited to the account. It needs permission to read account membership. If you want removal, it also needs permission to edit it.
Account ID	The Cloudflare account this connection is for.

A quick note on what's covered: this connection covers account members. These are the people who can sign in to the Cloudflare dashboard and manage this account. Your organization may also use Cloudflare Zero Trust. Its seats are a separate product, and this connection doesn't cover them.

Before you start

You need to be able to create an API token on the Cloudflare account. Cloudflare calls the people who can do this Super Administrators. An admin with permission to create tokens works too.
You need to know the Account ID for the account you're connecting.
If your organization has more than one Cloudflare account, each one needs its own connection. See More than one Cloudflare account below.

Step 1: Create the API token

In the Cloudflare dashboard, go to My Profile → API Tokens.
Click Create Token, then build a Custom Token.
Add these permissions:
- Account · Account Settings: choose Read to list members. Choose Edit if you also want Stacktic to be able to remove members.
- Account · Account Membership.
Under Account Resources, limit the token to the specific account you're connecting.
Create the token and copy it. Cloudflare only shows it once.

Cloudflare has its own walkthrough for creating a token: Create an API token.

Step 2: Find the Account ID

The Account ID is on any account page in the Cloudflare dashboard. It's part of the page's URL. It's also in the right-hand sidebar of the account home screen.

Step 3: Connect in Stacktic

In Stacktic, go to Tools → Cloudflare → Integration and enter:

API token: the token from Step 1.
Account ID: the ID from Step 2.

Click Connect. Stacktic checks the token by listing one member of the account. If the token or Account ID is wrong, Stacktic rejects the connection and tells you why.

Step 4: Turn on removal (when you're ready)

Stacktic starts reading members as soon as you connect. Removing a member during offboarding is a separate switch, because removal is destructive. It's off until you turn it on, even if the token has the Edit permission. When you're ready, turn on Automated user removal on the integration.

What you'll see

Once you're connected, Stacktic lists the account's members next to the rest of your tools.

Roles: each person's role shows up exactly as Cloudflare names it. Cloudflare doesn't use a fixed set of role names, so Stacktic just passes them through. A member with more than one role shows all of them.
Pending invitations: only members who've accepted their invitation appear. Someone Cloudflare still shows as pending (invited, but not yet accepted) doesn't have access yet. So Stacktic doesn't count them as a member.

What removal does (and doesn't do)

Removing a member deletes their membership on the account. That takes away their dashboard access. It also takes away any API access their roles gave them. It does not delete their personal Cloudflare account. It only removes their membership on this account.

Cloudflare itself refuses two kinds of removal. Stacktic tells you when this happens, instead of failing quietly:

Removing the account's last remaining Super Administrator. Give that role to someone else first.
Removing a member who's managed through SSO/an identity provider. You have to remove that membership at the identity provider, not through this API.

Security notes

Least privilege. Grant Read on Account Settings for visibility only. Add Edit only when you're ready to turn on removal.
The token can belong to a person or to the account. A token a person creates gets that person's own permissions. If they leave, Stacktic will flag the connection so you can reconnect. A service token owned by the account avoids that. Either kind works.
No expiry tracking. Cloudflare doesn't share a token's expiration date through the API Stacktic uses. So Stacktic can't warn you before a token runs out. If your token does expire, the connection will start failing, and Stacktic will ask you to reconnect then.
Stored encrypted. Stacktic keeps only the token and Account ID, both encrypted. It never shows the full token again.
You can cut it off anytime. Delete the token in Cloudflare (My Profile → API Tokens) and the connection stops working right away.

More than one Cloudflare account

Cloudflare accounts are separate from each other. A token works with one account at a time. If your organization has more than one Cloudflare account, connect each one separately, with its own token and Account ID. Each one shows up as its own card on the Integration tab.

Troubleshooting

Message in Stacktic	Likely cause and fix
Connection rejected at setup	The token is wrong, expired, or revoked. Or it doesn't have the Account Settings / Account Membership permissions on this account. Create a fresh token and reconnect.
Offboarding removal fails with a permission error	One of two things. The member may be the account's last Super Administrator: give that role to someone else first. Or the member is managed through SSO/an identity provider: remove them there instead.
Offboarding removal reports the member wasn't found	They were already removed from the account, or were never a member. Stacktic counts this as done.
Connection flips to needs reauthentication	The token was deleted, expired, or its permissions changed. Create a new token and reconnect.

Frequently asked questions

Does this cover Cloudflare Zero Trust seats? No. This connection covers account members, meaning dashboard and API access to the account itself. Zero Trust is a separate product with its own seats. This integration doesn't see or manage them.

Do I need to give Stacktic Edit access? No. Read is enough for visibility. You only need Edit if you also want Stacktic to remove members during offboarding. Even then, removal stays off until you turn it on separately.

Will connecting change or delete anything right away? No. Connecting only reads the account's current member list. Stacktic removes people only during an offboarding, and only after you turn on Automated user removal.

What if someone's access comes from being an Owner in another Cloudflare account, not a member of this one? Stacktic only sees membership on the connected account. A separate account needs its own connection. See More than one Cloudflare account.