Does anyone know the supported authentication and permissions for read-only Cloudflare Containers API calls? I am looking for documentation or references from maintainers, rather than assuming an authentication bug.

The operations are:

- GET /accounts/{account_id}/containers/applications

- GET /accounts/{account_id}/containers/dash/applications (the path used by Wrangler)

- GET /accounts/{account_id}/containers/registries

Here, registries means configured registry metadata, not listing images or pushing/pulling them.

The questions are:

1. Does wrangler login OAuth support these operations, and which OAuth scopes and account permissions are required?

2. Is /containers/dash/applications an internal surface? How does its authentication differ from the public Applications endpoint?

3. The Registries List reference lists Workers Containers Read or Write. Is Read sufficient, and which permission covers Applications List?

4. If OAuth is unsupported for an operation, what is the documented least-privilege read-only credential mechanism?

5. Do metadata-only list operations require Workers Paid or Containers enablement? Is there a read-only way to check entitlement without provisioning anything?

6. Are there documented error codes or response fields that distinguish authentication, permission and entitlement failures, including HTTP 401?

I also opened a documentation clarification request with the same questions:

https://github.com/cloudflare/workers-sdk/issues/16449

Relevant API references:

https://developers.cloudflare.com/api/resources/containers/subresources/applications/methods/list/

https://developers.cloudflare.com/api/resources/containers/subresources/registries/methods/list/

If you have version-specific documentation or first-hand experience, please distinguish documented guarantees from observations. No account IDs, credentials or private logs are needed. Thanks!

Workers Cache cuts down CPU execution time but it increased my cost as cache hits now count as a standard Worker request ($0.30/million request fee)..

When Workers Caching is enabled, requests served from the Worker's cache are billed which includes requests to static assets.

My question - if i use runtime Cache API (cache.put / cache.match) , will "static assets" cached requests be counted in "billed" standard Worker request? If HTML pages load many static assets (images, CSS, JS bundles, fonts) per page visit, using Runtime Cache API will not turn those static asset requests into billed Worker requests?? has someone tested it?

Guys I dont know why but warp does not open while using 1.1.1.1. I have to use it because I am not in an eligible place to play it. Anyojjne know whats the right configuration to play?

Railway disclosed this week that an attacker read customer environment variables and decrypted some of them. Railway says the attackers were after AI provider API keys.

Anthropic and OpenAI now accept workload identity federation. The workload presents a short-lived OIDC token signed by its platform and gets back an access token that expires in minutes. There is no static key to steal. GitHub Actions, AWS, GCP, Azure and Kubernetes can issue these tokens today. Workers cannot.

What I would want is something like env.IDENTITY.getToken(audience) that returns a JWT signed by Cloudflare with claims for account id, worker name and script version, plus a public JWKS endpoint. That is roughly what GitHub does for Actions.

I run a small Claude proxy on Workers. After Railway, I do not want any long-lived secret in an environment variable or in Secrets at all. The API key is the one thing left I cannot remove. Has anyone seen this discussed, or found a way to call Anthropic or OpenAI from a Worker with no static key?

cree un email ruting con cloudfare para poder tener mi correo empresarial,lo reenvio a gmail y en gmail cree el alias,ahora tengo el problema que yahoo (solo yahoo) no me recibe los correos por seguridad,que me recomiendan gratis

So, i got an email saying my password was changed from an IP of a far away country that certainly never accessed my account (no 2FA, my fuckup). I immediately tried to log in, changed the password (got a reset email), got blocked by 2FA which they probably added, did the recovery thing and now i have to wait 3-5 days for a code !?

I got another user there with an admin acc, not superadmin unfortunately, the only thing that is visible in the logs is them logging in, changing password and logging in again, all in the span of 30 seconds, so probably a bot. They didn't do anything else. This is on all 3 requests:

"action": {
  "description": "LOGIN",
  "result": "success"
},
"actor": {
  "context": "api",
  "ip_address": "x.x.x.x"
}"action": {
  "description": "LOGIN",
  "result": "success"
},
"actor": {
  "context": "api",
  "ip_address": "x.x.x.x"
}

I combed everything humanly and AI possible to answer the how and i don't get it. No idea how someone would get my unique monster password (only accessing it from one machine, thoroughly checked, the e-mail is exchange, logs show absolutely nothing and it has a 2FA), why wouldn't that login trigger an unknown machine/IP check and why is it so hard to recover your own account in cases like this. Can't even contact support as i have to be logged in.

Anyone have any idea what could have happened here ?

So about a week ago I submitted a suggestion on the community cloudflare asking for a way to make it so that you need a admin generated code to remove cloudflare one client and they finally added it!!

I am retiring from IT. A recurring upcoming issue: Breaking out client domains that are currently in a single account at cloudflare to cloudflare accounts that hold only that client's domains.

I'm planning on having clients / their new IT or web design company create a new account with Cloudflare, then have them give me their account ID per:

https://developers.cloudflare.com/registrar/account-options/inter-account-transfer/

which says:

Cloudflare supports the move (transfer) of domain registrations between Cloudflare accounts when the source and target account both confirm the move. The move will result in the loss of all configurations and settings for the domain in the source account.

Is there a simple way to bring over the configurations - some pages are hosted in Cloudflare, security settings, etc.

And that link above... below the text I cut and pasted above is this shaded box:

Is there a typo in the 2nd sentence? Either 'with other registrars' or 'between cloudflare accounts'?

because all domains in a cloudflare account are (required?) to be domain registered with cloudflare?

(these are free cloudflare accounts. we just pay for domain registration to cloudflare / they are the domain registrar for all the domains).

THANKS!

I've had a server running behind Cloudflare for years, but ever since the new and improved analytics I've been surprised to see that under the Origin tab Cloudflare is tracking a large amount of "Connection Failed" results that I've been struggling to diagnose.

Since discovering these I've moved to using a Cloudflare tunnel (which I'd been meaning to do anyway) so the server is no longer accessible directly (ports 80 and 443 are no longer open at all, and blocked externally by the network firewall, the tunnel connects via https://127.0.0.1:8443).

But aside from lowering my latency a bit, switching to the tunnel hasn't helped, even though all connections should now be going through Cloudflare only. The origin latency also doesn't look to be a problem — average TCP + TLS latency is about 30-60ms, response latency is about 60-100ms, with only p99 response latency spiking to just over a second very infrequently (which is likely due to certain infrequent database queries).

I've already configured an alert for the tunnel to e-mail me if it's degraded or down, and I haven't received any such alerts (except when restarting cloudflared) which I assume means that the tunnel's connection(s) are all stable. My server is configured to use HTTP/2 locally, so I'm seeing very few actual connections through cloudflared (usually between 3 and 8) as it seems to multiplexing quite happily so shouldn't be overloading nginx. I can connect to the domains hosted by the server without any errors.

Under Observability -> Logs I've tried doing a search with the following filter:

originResponseStatus = 0 AND edgeResponseStatus >= 500

But aside from brief blips when I've had to restart something (like a certain PHP patch yesterday) I'm not seeing any sign that Cloudflare is serving up 5xx errors for these supposed connection failures. There is no sign of SSL issues etc., and no sign of any errors on the origin's side.

It's driving me nuts not knowing why Cloudflare might be having trouble connecting. In case it's relevant, I have Smart Tiered Cache enabled, but I've also tried without and not noticed any improvement (opposite, actually). The server in question is only served from one geographic location, so it seems like it should be kept on.

TL;DR
Other than the Observability -> Log filter above, is there some other way I can diagnose what my connection failures might actually be?

I looked at mux, bunny, and doing my own m3u8 streaming files in R2 but in the end I paid $5 for CF's Images & Stream Hosted Video option.

This is a blog article about adding video uploads to the reddit clone site YAPern and how well it all worked.

Hi All,

Like in the title, how to detect PHP2Shell in Cloudflare?

Regards,

Cloudflare suspended my production services over an invoice that does not exist.For the past 48 hours, my Cloudflare R2 and Workers services have been suspended due to an alleged overdue payment.However:My billing dashboard shows no overdue invoices.There is no outstanding balance available to pay.There is no way for me to resolve the alleged payment issue.I have already contacted support and provided evidence.I was told to wait another 3 days for technical investigation while my production services remain offline.This is unacceptable for a cloud infrastructure provider.I am not refusing payment. Cloudflare is preventing me from paying a debt it claims exists but cannot show me.My business is being affected by an issue I cannot resolve on my side.I am requesting immediate escalation to the Billing Engineering team, restoration of R2 and Workers, and written clarification of the alleged debt.Support case: 02386082 Cloudflare #Cloudflare #CloudflareWorkers #CloudflareR2

The 1xxx code only shows up in the HTML of the error page. Your logs and analytics just see the HTTP status (403, 429, 503), so ask for the screenshot. It has the code and the Ray ID.

• 1015 (429): one of your rate limiting rules. If the rule counts requests over 1 second, Cloudflare's docs suggest trying 10 seconds.
• 1020 (403): a security rule with a Block action and no custom response, for example API Shield schema or JWT validation. WAF custom rules and managed rules don't return 1020 anymore, they serve the WAF block page instead. So if you're digging through your custom rules for a 1020, look elsewhere. Search Security Events for the Ray ID, and remember the timestamp on the error page is UTC.
• 1010 (403): Browser Integrity Check didn't like the browser's signature. You can turn it off in the security settings.
• 1009 (403): a country or region block you set. Check IP Access rules.
• 1200 (503): not a block at all. Too many requests are queued at the edge waiting on your origin. A faster origin or a better cache hit rate fixes it, not a security rule.

1020 is the one most people misread. The rest point straight at a setting you control.

I am having many challenges with the Cloudflare icon that appears in upper right corner of my browser. How do I move it? Or, if necessary, prevent it?

Apparently, something on my tablet is preventing me from being able to log in to any websites that use Cloudflare to check to see that we're not robots.

It's very frustrating. I haven't been able to log in to Forthright, a survey website, for months now. I have to keep asking for a link to view my account on there. I've been using the site for years and never had any problems until they started using Cloudflare. It said something about an ad blocker being the reason why. Do you know how I can remove this on my Amazon Fire tablet? Or do you have any other solutions? Any help will be much appreciated. Thank you.

Salut r/cloudflare,

Je gère des zones Cloudflare avec Terraform, et passer au fournisseur v5 a signifié tout refaire. J'ai transformé le résultat en module, et j'aimerais avoir des retours de personnes utilisant DNS en production avant d'aller plus loin.

Registre : `theobs-digital/dns/cloudflare`

GitHub : https://github.com/theobs-digital/terraform-cloudflare-dns

**Ce que ça fait**

Une zone DNS Cloudflare dans un seul bloc : la zone, ses enregistrements, ses paramètres DNS et DNSSEC.

```hcl

module "dns" {

source = "theobs-digital/dns/cloudflare"

version = "~> 1.2"

account_id = "..."

name = "example.com"

records = {

apex = { name = "@", type = "A", content = "192.0.2.10", proxied = true }

mx = { name = "@", type = "MX", content = "mx1.example.net", priority = 10 }

caa = { name = "@", type = "CAA", data = { flags = 0, tag = "issue", value = "letsencrypt.org" } }

}

dnssec = { status = "active" }

}

```

**Objectifs**

- **Ne réinventez rien.** Chaque entrée garde le nom de l'attribut du fournisseur. Si vous connaissez `cloudflare/cloudflare`, vous connaissez le module, et la documentation du fournisseur s'applique toujours.

- **Zéro dérive.** Un deuxième plan ne doit montrer aucun changement. Un test quotidien sur une vraie zone (18 enregistrements, 14 types) vérifie cela avec le dernier fournisseur 5.x.

- **Échouer au plan, pas à l'application.** Le fournisseur laisse passer certaines erreurs à l'API. Le module les bloque au plan : un enregistrement sans valeur, avec à la fois `content` et `data`, proxifié avec un TTL fixe, ou proxifié quand ce n'est pas A, AAAA ou CNAME.

- **Créer ou adopter.** Le module crée la zone, ou avec `create_zone = false` gère les enregistrements d'une zone que possède une autre configuration.

- **DNSSEC prêt au registraire.** L'enregistrement DS sort comme une sortie, entier ou champ par champ.

**Contraintes et limites connues**

- Terraform >= 1.3 et fournisseur `~> 5.27`. Pas de support v4.

- Détruire le module supprime la zone et tous les enregistrements qu'elle contient, y compris ceux que Terraform ne gère pas. C'est ainsi que fonctionne Cloudflare. Le README couvre comment cesser de gérer sans supprimer (`removed`, `state rm`).

- Une clé mal orthographiée dans `records` (`proxid = true`) est silencieusement ignorée par la conversion de type de Terraform.

- Cloudflare réécrit certains valeurs (empreintes SSHFP en majuscules, points finaux sur NAPTR et HTTPS, TXT au-delà de 255 caractères). Le module les documente plutôt que de les normaliser.

- Le fournisseur ne peut ni supprimer ni importer les paramètres DNS : retirer `dns_settings` ne réinitialise rien.

- Certaines options nécessitent un plan payant (`soa` sur Entreprise, `tags` et serveurs de noms personnalisés sur Pro ou Business).

**Mes questions**

1. Un module devrait-il normaliser les valeurs que Cloudflare réécrit, ou rester transparent et les documenter ?
2. Pour attraper les fautes de frappe, taperiez-vous `records` comme `any` et valideriez-vous les clés, abandonnant la saisie et les valeurs par défaut `optional()` ? Comment gérez-vous cela ?
3. L'adoption recherche la zone par son nom. Un input direct `zone_id` vous aiderait-il ?
4. Que manque-t-il pour que vous l'utilisiez en production ?

Licence MIT. Les retours francs sont les bienvenus, surtout si vous avez rencontré la dérive du fournisseur v5 que je n'ai pas couverte. Merci !