> For the complete documentation index, see [llms.txt](https://support.turngate.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.turngate.io/setup/integrations/cloudflare.md).

# Cloudflare

Turngate ingests audit logs from your Cloudflare account so you can investigate account- and zone-level activity alongside the rest of your SaaS audit data.

## Setting Up

### Preparing your Cloudflare Account

To set up the Cloudflare integration you need to be a Super Administrator on the Cloudflare account you want to connect. Audit logs are pulled at the account level, so a single Data Source will cover every zone in that account.

{% stepper %}
{% step %}

## Log in to Cloudflare

Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/) and select the account you want to connect.
{% endstep %}

{% step %}

## Open API Tokens

From the account home, open **Manage Account → API Tokens**.
{% endstep %}

{% step %}

## Create a custom token

Click **Create Token** and choose **Create Custom Token**.
{% endstep %}

{% step %}

## Configure token permissions

Give the token a descriptive name (e.g. `Turngate Audit Log Reader`) and grant the following permissions:

* **Account → Account Settings → Read**
* **Account → Audit Logs → Read**
* **Account → Access: Organizations, Identity Providers, and Groups → Read** (only required if you use Cloudflare Access and want those events included)
  {% endstep %}

{% step %}

## Scope the token to your account

Under **Account Resources**, scope the token to the specific account you want Turngate to monitor.
{% endstep %}

{% step %}

## Set token restrictions

Leave **Client IP Address Filtering** blank and set a **TTL** that matches your internal token-rotation policy.
{% endstep %}

{% step %}

## Create and copy the token

Click **Continue to summary**, then **Create Token**, and copy the token value. You will not be able to view it again.
{% endstep %}
{% endstepper %}

You will also need your **Account ID**, which is shown on the right-hand sidebar of any zone's Overview page in the Cloudflare dashboard.

{% hint style="info" %}
We recommend creating the token under a service account or shared admin identity rather than a personal login so that audit collection isn't interrupted if an individual leaves your organization.
{% endhint %}

### Setting up the Cloudflare Data Source in the Turngate App

Once you have your API token and Account ID, head back to the Turngate App.

{% stepper %}
{% step %}

## Open Data Sources

Click **Data Sources** in the navigation bar on the left.
{% endstep %}

{% step %}

## Install Cloudflare

Click **Install** on the **Cloudflare** selection.
{% endstep %}

{% step %}

## Name the Data Source

Give the Data Source a name for your own reference.
{% endstep %}

{% step %}

## Add credentials

Paste in the **Account ID** and **API Token** you generated above.
{% endstep %}

{% step %}

## Install the Data Source

Click **Install**.
{% endstep %}
{% endstepper %}

Turngate will validate the credentials and begin pulling audit logs. Up to 30 days of historical logs will be backfilled where available.

## Scopes Requested

* Account Settings — Read
* Audit Logs — Read
* Access: Organizations, Identity Providers, and Groups — Read (optional, only if Cloudflare Access events are desired)

## Other Resources

* [Cloudflare Audit Logs documentation](https://developers.cloudflare.com/fundamentals/account/account-security/review-audit-logs/)
* [Creating API tokens](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/)
* [Audit log event reference](https://developers.cloudflare.com/logs/reference/audit-logs/)