connect_cloudflare
Destructive
Connect a Cloudflare API token with DNS edit permissions to a domain to manage DNS records automatically.
Instructions
Connect a Cloudflare API token to a domain for automated DNS record management. Note: the API token will be visible in the AI conversation context.
ACCESS: needs a Proof account. Set PROOF_API_KEY and restart this server, or sign in with start_login — a session opens this tool — then call this tool again.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Domain ID | |
| api_token | Yes | Cloudflare API token with DNS edit permissions |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | MongoDB ObjectId | |
| domain | Yes | ||
| resend | No | Email-sending setup for a domain. Present once email sending has been set up. | |
| status | Yes | Domain verification status. `verifying` while a check runs; `revoking` while the owner's removal or revocation cascade holds the domain; `reverification_required` after a revoked proof, until control is shown again. | |
| proof_id | No | Public handle of the control proof backing this domain (`ph_ctl_<32 hex>`), resolved through the domain's mirroring asset — the same source `GET /me/assets` reads, so the two surfaces cannot disagree. Null when the domain has no proof, or when its proof predates the registry. | |
| provider | No | Never sent; read `detected_provider`. Kept for released SDK types; removed in the next major. | |
| oauth_url | No | Sent only by the add when Cloudflare sign-in is configured for the detected provider. | |
| created_at | Yes | ||
| from_email | No | ||
| profile_id | No | MongoDB ObjectId | |
| updated_at | Yes | ||
| check_count | Yes | ||
| dns_records | Yes | ||
| verified_at | No | ||
| proof_status | No | Registry status of that proof. A domain row can read `verified` while its proof is `revoked` — the row records that control was once shown, the proof records whether it still stands — so a client showing domain control must render THIS. Null means no registry record, which is NOT a revocation. | |
| error_message | No | Why the last check failed. | |
| provider_name | Yes | ||
| http_file_path | Yes | ||
| actual_dns_host | No | The host serving the zone, when it differs from the provider that verified it. | |
| last_checked_at | No | ||
| oauth_connected | Yes | Whether a Cloudflare connection is stored for this domain. | |
| txt_record_name | Yes | ||
| for_verification | Yes | ||
| has_dns_mismatch | Yes | ||
| proof_expires_at | No | When that proof expires — the signed token's own `exp`. `proof_status` stays `active` after this instant (nothing rewrites it), so a client must compare against the clock to tell a live proof from an expired one. Proofs inside 30 days of expiry are renewed automatically while control can still be confirmed. Carried even when `proof_id` is null (a proof that predates the registry still has a signed expiry); null when the domain has no proof, or its proof never stored one. | |
| supports_api_key | Yes | ||
| txt_record_value | Yes | ||
| detected_provider | Yes | The DNS provider read from the nameservers; `unknown` when none matched. | |
| for_email_sending | Yes | ||
| godaddy_connected | Yes | Whether a GoDaddy connection is stored for this domain. | |
| http_file_content | Yes | ||
| supports_auto_dns | Yes | Whether the detected provider can create the verification record itself. | |
| email_verification | No | An email verification of the domain. The code itself is never returned. | |
| supports_api_token | Yes | ||
| verified_providers | Yes | Every provider (or `email`) that has confirmed control. | |
| verification_method | Yes | `auto_dns`, `manual_dns`, `http_file` or `email`. | |
| actual_dns_host_name | No | ||
| dns_mismatch_warning | No | Sent only while `has_dns_mismatch` is true. | |
| proof_revoked_reason | No | Reason the registry recorded, present only while `proof_status` is `revoked`. | |
| verification_subtype | No | How a provider verified the domain: by creating the record, or by confirming ownership without one. | |
| email_sending_enabled | No | Never sent; read `for_email_sending`. Kept for released SDK types; removed in the next major. | |
| has_provider_credentials | No | Sent only by the add: the account already holds credentials for the detected provider. | |
| provider_credential_name | No | Sent only by the add, with `has_provider_credentials`. |