Cloudflare

Each MetricPoints team connects its own Cloudflare account using its own API token. One team administrator completes setup, then authorized administrators on that team can use the connection. There is no shared platform Cloudflare account, and individual teammates do not need separate tokens.

You can save several connections: one for your agency account and others for client accounts. Use a team default for most sites and select a different connection for exceptions. External monitoring does not require a Cloudflare connection.

Before you start

• You need administrator access to the correct MetricPoints team.
• You need permission to create a token in the Cloudflare account that contains the domains you want to manage. If a client owns that account, ask their authorized administrator to create a dedicated token.
• Decide which domains this connection should cover. Start with a small selection if you are trying the integration for the first time.

Saving and verifying a connection reads the domains it can access. It does not add challenges, block visitors, change DNS, or bypass challenges for monitoring.

1. Create a Cloudflare API token

1. Sign in to the Cloudflare dashboard (opens in a new tab) and select the account containing your domains.
2. Open Manage account → Account API tokens → Create Token. Account-owned tokens are recommended for a lasting team connection because they are not tied to an individual employee. Creating one requires Super Administrator status or API Token Provisioning capabilities.
3. Name the token something recognizable, such as MetricPoints — Agency sites.
4. Add the permissions and domain restrictions below, review the summary, then choose Create Token.
5. Copy the token when Cloudflare displays it. Keep it in your password manager until you have saved it in MetricPoints.

If you cannot create an account-owned token, a user-owned token also works: open My Profile → API Tokens → Create Token → Create Custom Token. It depends on that user's Cloudflare access remaining valid. Use a dedicated API token, not a Global API Key.

2. Choose permissions and domains

In the account token picker, permissions are grouped into categories with Read and Edit checkboxes. Find Zone under DNS & Zones; search the full permission list for Zone WAF and Cache Purge. The paths below describe the permissions, not a required sequence of dropdowns:

• Zone → Zone → Read: required to find and verify accessible domains.
• Zone → Zone WAF → Edit: required for manual IP challenges, blocks, removal, and expiry cleanup. Cloudflare's API documentation calls this permission Zone WAF Write or Zone WAF Edit.
• DNS → Read and Edit: add these if your team will view and manage DNS records through MetricPoints. DNS Edit grants record changes; Zone Edit is a different permission and is not needed for this workflow.
• Zone → Cache Purge → Purge: optional; add it if you want to use MetricPoints cache-purge actions.

For connection setup alone, Zone Read is enough. Add the other permissions when you want those actions. DNS permissions are only needed for DNS management. Account administration and Zone Edit permissions are not needed for these workflows.

Under Zone Resources, include the specific zones you want this connection to manage. A zone is a domain such as example.com, not a page such as /books. If you intentionally want every domain in your agency's Cloudflare account available, select all zones within that account. Avoid granting access to unrelated accounts.

The token's WAF permission covers the chosen zones; it is not limited by Cloudflare to rules created by MetricPoints. MetricPoints itself only removes restrictions that it created and that have not been changed elsewhere.

• Client IP Address Filtering: leave this unset unless you have confirmed the outbound API addresses with MetricPoints support. The monitoring server addresses are not necessarily the complete list of servers making Cloudflare API calls.
• Token expiration: choose a date your team can manage and schedule renewal before it. Temporary restrictions need a valid token to be removed when their duration ends.

Cloudflare reference: account-owned tokens, user-owned tokens, WAF permissions, and cache-purge permissions.

3. Save the connection in MetricPoints

1. In Cloudflare, open a domain's Overview page and find the Account ID in the API information. Copy the Account ID, not the Zone ID.
2. In MetricPoints, select the correct team and open Team Settings → Cloudflare connections → Add connection.
3. Enter a Connection name, the Cloudflare account ID, and the API token.
4. Leave Enable manual security actions for this connection unchecked if you only want to connect and verify access. Enable it when your team is ready to use manual challenges and blocks and the token has WAF Edit permission.
5. Choose Verify and save. A saved connection shows its accessible zone count and verification time. MetricPoints encrypts the token and does not display it again.

Verification confirms domain access. Cloudflare checks write permissions and plan limits when an action runs, so a verified connection alone does not prove that challenges, blocks, or cache purges are permitted.

4. Choose your team default and site exceptions

1. In Team Settings → Cloudflare connections, select your usual connection under Team default and choose Save default.
2. Open a site from All Sites, then open Settings → Cloudflare connection and IP restrictions.
3. Choose the appropriate option below and click Save selection. Check that the displayed connection and zone are correct.

• Use team default: use your team's default connection, provided its token includes this site's zone.
• Use another team connection: select a saved connection for a different client account or a narrower set of domains.
• Keep existing zone connection: retain a previously configured site connection. Existing connections stay selected until you explicitly switch them.
• Disable Cloudflare for this site: stop using a connection for new actions on this site. Removal of existing restrictions still uses the original connection.

For example, Agency Cloudflare can be the default for 20 sites. A client with a separate Cloudflare account gets a second team connection, selected only on that client's sites. Another MetricPoints team sets up its own connections independently.

Optional: manage DNS records

Open the site's Settings → Cloudflare DNS records. Use DNS Read to view records and DNS Edit to add, edit, or remove them. Each write requires a before/after preview, a reason, and confirmation of the zone name. DNS changes apply to the entire zone, which may include other sites and email services.

Viewing and previews work while DNS writes are disabled during rollout. Follow the DNS management guide for record types, confirmations, and verification.

Optional: challenge or block an IP

When manual security actions are available and enabled, enter one IPv4 or IPv6 address, choose Managed Challenge or Block, add a reason, and select a duration. Review the exact hostname before choosing Apply restriction and confirming. Aliases and other subdomains are excluded; existing Cloudflare rule order still applies.

Use Refresh status in Restriction history to see progress, Verify status to request a fresh check, or Remove this restriction to request removal. Removing a MetricPoints restriction does not remove other Cloudflare rules affecting that IP.

Expiry schedules a removal; it is not a Cloudflare timer. If removal cannot be confirmed, the restriction may remain active and the history shows it as overdue. Keep the original connection valid until removal is confirmed, even if you change the site's selected connection. MetricPoints never creates visitor blocks automatically from monitoring observations.

Help with common problems

• I cannot see the connection settings: confirm that you selected the right MetricPoints team and have team administrator access.
• Verification fails or finds no domains: check the Account ID, Zone Read permission, selected zones, token expiration, and any client IP filter. The account must match the domains the token can access.
• A domain is missing: add it to the token's allowed zones in Cloudflare, then use Refresh or rotate token in MetricPoints. Re-enter the token and choose Verify and save to refresh the accessible zones.
• My site still uses its old connection: explicitly select Use team default or Use another team connection in that site's settings. Saving a team default preserves existing site connections.
• Actions are unavailable: check the connection's manual security setting. Actions may also be unavailable during rollout; contact MetricPoints support if the page says they are disabled.
• Verification succeeds but an action fails: check WAF Edit or Cache Purge permission, token validity, and Cloudflare plan or rule limits. Review the recorded result before trying again.
• A restriction is overdue or changed outside MetricPoints: check its history and the rule in Cloudflare. Restore token access if needed and choose Verify status. Externally edited rules require review before cleanup can continue; contact support if removal remains unconfirmed.
• A token needs replacing: create a replacement with the same required zone access and permissions, then use Refresh or rotate token → Verify and save. Revoke the old token after the replacement is saved. Connections retained by restriction history cannot be deleted.

Need help? Contact [email protected] with the connection name and the displayed error. Do not include your API token.