infrastructure//Cloudflare//API token

An API token is the credential a script uses to act on Cloudflare, and each one carries its own permissions. A token issued to publish a Pages project can modify that project and nothing else; editing the records of a zone needs a different token with DNS permission. The registrar is a third key again, since it controls the delegation. It is the same idea as an access token, a string that carries a permission, issued here by hand for a machine with no user session behind it. An API key mostly identifies which app is calling; a Cloudflare API token is scoped, and the scope is the whole point.

An API token is the credential a script uses to act on Cloudflare, and each one carries its own permissions. A token issued to publish a Pages project can modify that project and nothing else; editing the records of a zone needs a different token with DNS permission. The registrar is a third key again, since it controls the delegation. It is the same idea as an access token, a string that carries a permission, issued here by hand for a machine with no user session behind it. An API key mostly identifies which app is calling; a Cloudflare API token is scoped, and the scope is the whole point.

Keeping them separate bounds a leak. Whoever obtains the publishing token can replace the site and cannot touch the DNS of the domain, which is the reason to issue the DNS key apart.

A configuration file that lists which zones and projects belong to a deployment describes resources; it grants nothing. Declaring a zone there is a local statement, this domain is ours, and the permission comes only from the token. A zone can sit declared for hours before the credential exists, and during those hours nothing can be written to it.