infrastructure//Cloudflare//API token

An API token is the credential a script uses to act on Cloudflare, and each one carries its own permissions. A token issued to publish a Pages project can modify that project and nothing else; editing the records of a zone needs a different token with DNS permission. The registrar is a third key again, since it controls the delegation.

An API token is the credential a script uses to act on Cloudflare, and each one carries its own permissions. A token issued to publish a Pages project can modify that project and nothing else; editing the records of a zone needs a different token with DNS permission. The registrar is a third key again, since it controls the delegation.

Keeping them separate bounds a leak. Whoever obtains the publishing token can replace the site and cannot touch the DNS of the domain, which is the reason to issue the DNS key apart.

A configuration file that lists which zones and projects belong to a deployment describes resources; it grants nothing. Declaring a zone there is a local statement, this domain is ours, and the permission comes only from the token. A zone can sit declared for hours before the credential exists, and during those hours nothing can be written to it.