Cloudflare
Connect your customers' Cloudflare accounts so Askel can read zone configuration, WAF rules, and traffic controls as part of your onboarding or security-review workflow. A scoped API token is all it takes, and the token never passes through your servers.
What you can do
List and inspect all zones
Pull every zone in the customer's account, including zone ID, name, status, and nameservers, so your product can scope later reads to the right zone without asking the customer to look anything up.
Read DNS records per zone
Fetch A, CNAME, MX, TXT, and other record types for any zone. Useful for validating domain ownership, checking routing, or detecting misconfigured SPF and DMARC records before onboarding completes.
Audit WAF rules and managed rulesets
Read the customer's active WAF custom rules and managed-ruleset overrides, including rule expressions like (http.request.uri.path contains "/admin"), so your security product can show coverage gaps.
Read rate-limiting rules
Pull rate-limit configurations, including thresholds, matching expressions, and action types, to verify that API endpoints are protected before a go-live or compliance check.
Inspect Workers and Routes
List deployed Workers scripts and their route patterns so your product can map which logic runs at the edge for a given zone without needing access to the source code.
Check Page Rules and Transform Rules
Read forwarding and rewrite rules to understand how traffic is being modified at the edge. Helpful for diagnosing redirect conflicts or verifying that expected rules are active.
Security posture review during customer onboarding
You sell a cloud security posture product. When a new customer, Redpine Technologies, signs up, your onboarding flow needs to verify that their public-facing zones have WAF enabled, that known bad-actor IPs are blocked, and that rate limiting is in place on their login endpoint. Previously, a Redpine network engineer had to do this by hand and send screenshots.
- 1
Customer creates a scoped token
Redpine's admin opens My Profile in the Cloudflare dashboard, goes to API Tokens, and creates a token with Zone Read and Firewall Services Read permissions scoped to the redpine.io zone. They paste the token into Askel's connection wizard.
- 2
Zone discovery
Askel calls GET /zones and lists every zone on the account. Your onboarding flow selects redpine.io and stores the zone ID for subsequent reads.
- 3
WAF and rate-limit audit
Askel fetches the active WAF custom rules and rate-limit rules for redpine.io. Your product checks for a rule targeting the /login path and flags it as missing when none is found.
- 4
Findings surfaced to the customer
Your product displays a checklist: WAF is active on redpine.io, but no rate-limit rule exists for /login. Redpine's admin is shown the exact API expression to add and can fix it before the posture score is finalised.
- 5
Re-check and pass
Redpine adds the rate-limit rule in their Cloudflare dashboard. Your product re-reads the rules via Askel, finds the new rule matching (http.request.uri.path eq "/login"), and marks the check as passing.
API token
Customer's Cloudflare account admin creates a scoped API token in the dashboard (My Profile -> API Tokens) with the requested permissions, and pastes it into Askel. Askel sends it as `Authorization: Bearer <token>` per request; the token never reaches your servers.
How Askel sits between your product and the customer's system
FAQ for Cloudflare
What permissions does the API token need?+
Can the token be scoped to a single zone?+
What happens if the customer rotates or revokes the token?+
Does Askel support Cloudflare accounts with multiple zones across different plans?+
catching drift before it breaks, and hitting go-live dates.
© 2025 Askel.ai. All rights reserved.