Create a read-only Cloudflare API token for Health Check AI

Health Check AI reviews your Cloudflare configuration through the Cloudflare API, read-only. It changes nothing in your account: the token you create here can only read settings and analytics, and you can delete it the moment the assessment is done.

Creating the token takes about five minutes. You need to be an Administrator or Super Administrator of the Cloudflare account that holds the domain.

Before you start

Never share a Cloudflare password, a Global API Key or a token with wider permissions than those below. The InCloud team will only ever ask for this read-only token, never in the chat with Cyntra, and will tell you how to hand it over securely when they arrange the assessment.
Create the token in the account that holds the domain (zone) being assessed. If the domain is in a separate account from the rest of your estate, create the token there.
If your organisation requires it, have the token reviewed by your security team first: the permission list below is the complete list.

Create the token

Sign in to the Cloudflare dashboard, open your profile menu (top right) and choose My Profile, then API Tokens. (In accounts with the newer navigation, go to Manage Account, then Account API Tokens.)
Choose Create Token, then Create Custom Token (Get started).
Name the token, for example InCloud Health Check AI (read-only).
Under Permissions, add one row per permission listed below, each set to Read. Use the Zone rows for the zone permissions and the Account rows for the account permissions.
Under Zone Resources, choose Include, Specific zone, and select the domain registered for the assessment (or All zones, if you prefer InCloud to assess further domains later).
Under Account Resources, choose Include and the account that holds the domain.
Leave Client IP Address Filtering empty, and set a TTL (end date) a few weeks ahead, so the token expires by itself after the assessment.
Choose Continue to summary, check that every permission says Read, then Create Token.
Copy the token when it is shown: Cloudflare shows it once. Keep it somewhere safe until the InCloud team asks for it when arranging the assessment; never paste it into the chat with Cyntra.

Permissions to add

Zone permissions (each one Read):

Zone Read
Zone Settings Read
DNS Read
Zone WAF Read
Firewall Services Read
Bot Management Read
Cache Rules Read
Config Rules Read
Origin Rules Read
Transform Rules Read
Managed Headers Read
Single Redirect Read
Page Rules Read
SSL and Certificates Read
Load Balancers Read
Health Checks Read
HTTP DDoS Managed Ruleset Read
Zone Versioning Read
Analytics Read
Logs Read
Access: Apps and Policies Read
API Gateway Read
Client-side security Read
Custom Error Rules Read
Waiting Room Read
Workers Routes Read

Account permissions (each one Read):

Account Settings Read
Account Analytics Read
Account WAF Read
Account Rulesets Read
Account Firewall Access Rules Read

A permission that does not appear in your account, for example a product you do not use, can be left out. If a permission is missing, the report simply notes that the area could not be checked.

After the assessment

Delete the token in API Tokens (or let it expire): the assessment needs it only while it runs.
The token never leaves InCloud's assessment environment, and nothing in your account is changed by the assessment.
Questions about the token or the assessment: reply to your confirmation email and the InCloud team will help.