## Cloudflare

### Getting the Cloudflare Account ID

1. Log in to the Cloudflare dashboard: https://dash.cloudflare.com

2. Go to **Compute** > **Workers & Pages** in the left sidebar.

3. **Account ID** will be on the right-hand sidebar of the Overview page.  It's a 32-character hex string.

### Cloudflare Token Creation

1. Go to the token page
https://dash.cloudflare.com/profile/api-tokens

2. Click "Create Token"

3. Find "Edit Cloudflare Workers" in the templates list, click "Use template"

4. Name the token.

5. Account Resources: Include: The account

6. Zone Resources: Include: The zone

7. Click "Continue to summary"

8. Click "Create Token"

9. The token will only be displayed once.

### Where the token goes

**Into the environment, never into `pulumi config`.**

```bash
export CLOUDFLARE_API_TOKEN=...
pulumi up
```

`pulumi-cloudflare` falls back to `CLOUDFLARE_API_TOKEN` when `cloudflare:apiToken` is
not set in config, so this needs no change to `__main__.py`.

Do **not** run `pulumi config set cloudflare:apiToken --secret`. On this stack that writes
ciphertext into the committed `Pulumi.dev.yaml`, next to a committed salt, unlocked by a
passphrase documented in `../README.md`. See `./PASSPHRASE.md`.

For anything unattended later, put it in a GitHub Actions secret and export it in the job
rather than committing it in any form.

### If a token has been exposed

Rotating the value is the only fix — rewriting git history does not help, because anyone
with repo access has already been able to read it for as long as it was pushed.

1. https://dash.cloudflare.com/profile/api-tokens, signed in as the user who created it
   (tokens are user-scoped, so only that user sees them).
2. Check **Last used** before doing anything — deleting the token destroys the only
   record of whether it was used.
3. **Roll** to keep the token and issue a new value, or **Delete** and create a fresh one
   from the steps above.