<!-- metadata: { "openclaw": { "requires": { "bins": ["cloudflare-cli"], "env": ["CLOUDFLARE_API_TOKEN"] } } } -->

Cloudflare Management Skill

Use the cloudflare-cli command to manage Cloudflare domains, DNS records, SSL/TLS settings, cache, and analytics.

Prerequisites

• CLOUDFLARE_API_TOKEN environment variable must be set
• Token needs these permissions:
• Zone:Read, Zone:Edit
• DNS:Read, DNS:Edit
• SSL and Certificates:Read, SSL and Certificates:Edit
• Cache Purge:Purge
• Analytics:Read

Command Reference

Zones (Domains)

# List all zones
cloudflare-cli zones list

# Filter by domain name
cloudflare-cli zones list --name example.com

# Get zone details
cloudflare-cli zones get <zone-id>

DNS Records

# List all DNS records for a zone
cloudflare-cli dns list <zone-id>

# Filter by type
cloudflare-cli dns list <zone-id> --type A
cloudflare-cli dns list <zone-id> --type CNAME

# Create DNS records
cloudflare-cli dns create <zone-id> -t A -n www -c 192.168.1.1 --proxied
cloudflare-cli dns create <zone-id> -t CNAME -n blog -c example.com --proxied
cloudflare-cli dns create <zone-id> -t MX -n @ -c mail.example.com --priority 10
cloudflare-cli dns create <zone-id> -t TXT -n @ -c "v=spf1 include:_spf.google.com ~all"

# Update DNS record
cloudflare-cli dns update <zone-id> <record-id> -c 192.168.1.2

# Delete DNS record
cloudflare-cli dns delete <zone-id> <record-id>

SSL/TLS

# Get Universal SSL settings
cloudflare-cli ssl settings <zone-id>

# Enable/Disable Universal SSL
cloudflare-cli ssl enable <zone-id>
cloudflare-cli ssl disable <zone-id>

# List SSL certificates
cloudflare-cli ssl certificates <zone-id>

# Check SSL verification status
cloudflare-cli ssl verification <zone-id>

Cache

# Purge everything
cloudflare-cli cache purge <zone-id> --all

# Purge specific URLs
cloudflare-cli cache purge <zone-id> --files https://example.com/page1 https://example.com/page2

# Purge by cache tags
cloudflare-cli cache purge <zone-id> --tags tag1 tag2

Analytics

# Get analytics for last 24 hours
cloudflare-cli analytics dashboard <zone-id> --since -1d --until now

# Get analytics for last 7 days
cloudflare-cli analytics dashboard <zone-id> --since -7d --until now

# Get analytics for specific date range (ISO format)
cloudflare-cli analytics dashboard <zone-id> --since 2024-01-01T00:00:00Z --until 2024-01-31T23:59:59Z

Output Format

All commands output JSON for easy parsing. Example:

{
  "id": "abc123",
  "name": "www.example.com",
  "type": "A",
  "content": "192.168.1.1",
  "proxied": true,
  "ttl": 1
}

Errors are also returned as JSON:

{
  "error": "Cloudflare API error: Invalid zone identifier"
}

Common Workflows

Add a new subdomain pointing to an IP

# First, get the zone ID
cloudflare-cli zones list --name example.com

# Create the A record (replace <zone-id> with actual ID)
cloudflare-cli dns create <zone-id> -t A -n subdomain -c 123.45.67.89 --proxied

Update DNS after server migration

# List current records
cloudflare-cli dns list <zone-id> --type A

# Update the record with new IP
cloudflare-cli dns update <zone-id> <record-id> -c 98.76.54.32

# Purge cache to ensure changes propagate
cloudflare-cli cache purge <zone-id> --all

Setup email DNS records

# Add MX record
cloudflare-cli dns create <zone-id> -t MX -n @ -c mail.example.com --priority 10

# Add SPF record
cloudflare-cli dns create <zone-id> -t TXT -n @ -c "v=spf1 include:_spf.google.com ~all"

# Add DKIM record
cloudflare-cli dns create <zone-id> -t TXT -n google._domainkey -c "v=DKIM1; k=rsa; p=..."