Cloudflare integration: your DNS, handled with a scoped token
One token per zone, unproxied records and a rollback that restores every setting.
With a Cloudflare API token scoped to your domain's DNS, Pilotiko reads your records, keeps a snapshot and can replace the website records during a cutover that you confirm. Status: Being commissioned: the connector is written and tested against a test server; it has not yet been verified with a real account.
In short
- The token is built from Cloudflare's Edit zone DNS template and restricted to one zone.
- You paste it once; it is encrypted and never displayed again.
- Records created by Pilotiko are set to DNS only (grey cloud).
- Switching the domain over is a step you confirm yourself.
What does the Cloudflare connection do?
It gives Pilotiko DNS access to a single zone, enough to read and replace records, and nothing else in your Cloudflare account.
For this job Cloudflare works with API tokens rather than a one-click authorization. Your Cloudflare profile has a token page with an Edit zone DNS template, and each token can be limited to specific zones; any other zone simply returns an error [1]. Pilotiko asks for that minimum: Zone, DNS, Edit on the one domain involved.
With the token, the connector confirms it can reach the zone, lists every record and then replaces or deletes the website records through Cloudflare's DNS records API [3]. Firewall rules, caching and billing are out of reach.
One detail matters: the records Pilotiko creates are DNS only. When a record is proxied (orange cloud), lookups return Cloudflare addresses; when it is DNS only (grey cloud), they return your server's real address [2]. Pilotiko has to be reached directly so it can prove it serves your domain and obtain its HTTPS certificate.
- Permission requested: Zone, DNS, Edit, limited to one zone.
- Read: every record in the zone, including type, name, value, TTL and proxy state.
- Written: only the A, AAAA or CNAME records for the bare domain and www, at cutover time.
- Needs your approval: the domain cutover, a manual step in the transition flow.
How do you connect Cloudflare to Pilotiko?
- 1
Open the API Tokens page
In Cloudflare, go to My Profile, then API Tokens, and choose Create Token.
- 2
Start from Edit zone DNS
Keep the Zone, DNS, Edit permission and add nothing else.
- 3
Limit it to one zone
Under resources, pick only the domain Pilotiko will serve. Don't grant all zones.
- 4
Copy the token right away
Cloudflare shows the secret only once. Paste it into Pilotiko at the "Access the domain's DNS" step of the transition flow; it is checked, encrypted and hidden for good.
- 5
Review the snapshot and the plan
Pilotiko saves your current records and shows exactly what it would change before the cutover.
What is available, being commissioned or coming soon?
| Feature | Status | Detail |
|---|---|---|
| DNS and HTTPS check without a connection | Available | Public lookup done by Pilotiko, no token needed |
| Checking the token's access to the zone | Being commissioned | Tested against a fake Cloudflare server |
| Reading and saving records | Being commissioned | Snapshot taken before any change |
| Replacing or deleting the website records | Being commissioned | Always grey cloud; exact rollback |
| Proxy, cache or firewall settings | Coming soon | Not built; outside the requested permission |
| Buying or transferring a domain | Coming soon | No registrar connected |
What actually changes during a Cloudflare cutover?
How is your data protected, and how do you revoke access?
The token is encrypted at rest (AES-256-GCM) and never leaves Pilotiko's server. DNS records are technical, yet a snapshot can reveal service names or people's names. Quebec's private-sector privacy act calls for security measures that are reasonable given the sensitivity of the information (s. 10), and a privacy impact assessment before personal information is communicated outside Quebec (s. 17) [4]. See also our security page.
Revoking takes two moves. In Pilotiko, choose Disconnect: the token is erased and the action is written to the audit log. In Cloudflare, delete the token on the page where you created it; from then on no request from Pilotiko gets through, even if a copy existed somewhere.
What are the Cloudflare-specific limits?
Domain at GoDaddy instead? See the GoDaddy integration. Your old site's content is read by the WordPress integration, and past bookings come in through Acuity Scheduling. Everything at a glance: all integrations.
- A deliberate trade-off: Cloudflare recommends DNS only just for records that don't serve web traffic [2]. The website records served by Pilotiko therefore lose Cloudflare's proxy protection and caching.
- A token covering all zones would work, but Pilotiko will ask you to narrow it: a broad token is a needless risk.
- If the MX record or a mail alias (mail, smtp, imap, webmail, autodiscover) points at the same server as the website, the cutover is blocked and Pilotiko proposes a fix first.
- No real Cloudflare account has been tried yet; the first real run is the validation step.
Frequently asked questions
Why doesn't Pilotiko keep the orange cloud?
Pilotiko must be reached directly to prove it serves your domain and to get its HTTPS certificate, so it creates its records as DNS only. Records it reads as proxied are saved that way in the snapshot.
Can the token change other domains in my account?
Not if you restrict it to one zone, as Cloudflare allows; other zones then return an error. Pilotiko recommends never granting all zones.
Could my email go down during the cutover?
Pilotiko checks the MX record and mail aliases before changing anything. If email depends on the website's server, the cutover is blocked and a specific fix is proposed.
What if I lose the token?
Cloudflare shows the secret only once. Create a new one with the same restrictions, paste it into Pilotiko, then delete the old one in Cloudflare.
Can I undo a cutover?
Yes. The reverse plan restores the snapshot's records with their original value, TTL and proxy state.
Do I need a paid Cloudflare plan?
Pilotiko only uses the DNS API and API tokens. We don't publish a list of compatible Cloudflare plans, so check that your account lets you create a token limited to one zone.
Sources
- Cloudflare Docs, Create API token (accessed on October 15, 2026).
- Cloudflare Docs, Proxy status (accessed on October 15, 2026).
- Cloudflare Docs, API reference: DNS records (accessed on October 15, 2026).
- LégisQuébec, Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) (accessed on October 15, 2026).
Read next
Pilotiko integrations
Google Calendar, Outlook, Zoom, Stripe, LinkedIn, Cloudflare, Twilio and more: what each Pilotiko connection does today, with its status read from the code.
GoDaddy integration: your domain's DNS, without guesswork
Domain registered at GoDaddy? Pilotiko reads and updates its DNS with an API key and secret, protects your email records and keeps a full rollback plan.
WordPress integration: Pilotiko reads your existing site
Pilotiko reads the pages, posts and Yoast tags of your WordPress site through its public REST API, with no password, to start your new site from real content.