# Cloudflare integration: your DNS, handled with a scoped token

> Connect your Cloudflare zone to Pilotiko with a token limited to one domain's DNS: snapshot first, email safety checks and an exact rollback plan built in.

Updated on October 15, 2026 · https://app.pilotiko.com/en/integrations/cloudflare

With a Cloudflare API token scoped to your domain's DNS, Pilotiko reads your records, keeps a snapshot and can replace the website records during a cutover that you confirm. Status: Being commissioned: the connector is written and tested against a test server; it has not yet been verified with a real account.

## In short
- The token is built from Cloudflare's Edit zone DNS template and restricted to one zone.
- You paste it once; it is encrypted and never displayed again.
- Records created by Pilotiko are set to DNS only (grey cloud).
- Switching the domain over is a step you confirm yourself.

## What does the Cloudflare connection do?

It gives Pilotiko DNS access to a single zone, enough to read and replace records, and nothing else in your Cloudflare account.

For this job Cloudflare works with API tokens rather than a one-click authorization. Your Cloudflare profile has a token page with an Edit zone DNS template, and each token can be limited to specific zones; any other zone simply returns an error [1]. Pilotiko asks for that minimum: Zone, DNS, Edit on the one domain involved.

With the token, the connector confirms it can reach the zone, lists every record and then replaces or deletes the website records through Cloudflare's DNS records API [3]. Firewall rules, caching and billing are out of reach.

One detail matters: the records Pilotiko creates are DNS only. When a record is proxied (orange cloud), lookups return Cloudflare addresses; when it is DNS only (grey cloud), they return your server's real address [2]. Pilotiko has to be reached directly so it can prove it serves your domain and obtain its HTTPS certificate.

- **Permission requested**: Zone, DNS, Edit, limited to one zone.
- **Read**: every record in the zone, including type, name, value, TTL and proxy state.
- **Written**: only the A, AAAA or CNAME records for the bare domain and www, at cutover time.
- **Needs your approval**: the domain cutover, a manual step in the transition flow.

## How do you connect Cloudflare to Pilotiko?

1. **Open the API Tokens page** — In Cloudflare, go to My Profile, then API Tokens, and choose Create Token.
2. **Start from Edit zone DNS** — Keep the Zone, DNS, Edit permission and add nothing else.
3. **Limit it to one zone** — Under resources, pick only the domain Pilotiko will serve. Don't grant all zones.
4. **Copy the token right away** — Cloudflare shows the secret only once. Paste it into Pilotiko at the "Access the domain's DNS" step of the transition flow; it is checked, encrypted and hidden for good.
5. **Review the snapshot and the plan** — Pilotiko saves your current records and shows exactly what it would change before the cutover.

## What is available, being commissioned or coming soon?

| Feature | Status | Detail |
|---|---|---|
| DNS and HTTPS check without a connection | Available | Public lookup done by Pilotiko, no token needed |
| Checking the token's access to the zone | Being commissioned | Tested against a fake Cloudflare server |
| Reading and saving records | Being commissioned | Snapshot taken before any change |
| Replacing or deleting the website records | Being commissioned | Always grey cloud; exact rollback |
| Proxy, cache or firewall settings | Coming soon | Not built; outside the requested permission |
| Buying or transferring a domain | Coming soon | No registrar connected |

## What actually changes during a Cloudflare cutover?

**Example: a 17-record Cloudflare zone for a Halifax electrician**

The zone holds the website at a web host, email at an outside provider and a booking subdomain. Both website records are proxied.

- Records read and saved : 17
- Records changed at cutover : 2 (bare domain and www)
- Email records touched : 0 (MX and SPF unchanged)
- TTL ahead of the cutover : lowered to 600 seconds
- Proxy state of the 2 new records : DNS only
- Records restored by a rollback : 2, proxied as before
- **= 2 of 17 records change; a rollback puts both original values back, orange cloud included.**

## How is your data protected, and how do you revoke access?

The token is encrypted at rest (AES-256-GCM) and never leaves Pilotiko's server. DNS records are technical, yet a snapshot can reveal service names or people's names. Quebec's private-sector privacy act calls for security measures that are reasonable given the sensitivity of the information (s. 10), and a privacy impact assessment before personal information is communicated outside Quebec (s. 17) [4]. See also our [security page](/en/security).

Revoking takes two moves. In Pilotiko, choose Disconnect: the token is erased and the action is written to the audit log. In Cloudflare, delete the token on the page where you created it; from then on no request from Pilotiko gets through, even if a copy existed somewhere.

## What are the Cloudflare-specific limits?

Domain at GoDaddy instead? See the [GoDaddy integration](https://app.pilotiko.com/en/integrations/godaddy). Your old site's content is read by the [WordPress integration](https://app.pilotiko.com/en/integrations/wordpress), and past bookings come in through [Acuity Scheduling](https://app.pilotiko.com/en/integrations/acuity-scheduling). Everything at a glance: [all integrations](https://app.pilotiko.com/en/integrations).

- A deliberate trade-off: Cloudflare recommends DNS only just for records that don't serve web traffic [2]. The website records served by Pilotiko therefore lose Cloudflare's proxy protection and caching.
- A token covering all zones would work, but Pilotiko will ask you to narrow it: a broad token is a needless risk.
- If the MX record or a mail alias (mail, smtp, imap, webmail, autodiscover) points at the same server as the website, the cutover is blocked and Pilotiko proposes a fix first.
- No real Cloudflare account has been tried yet; the first real run is the validation step.

## Frequently asked questions

### Why doesn't Pilotiko keep the orange cloud?

Pilotiko must be reached directly to prove it serves your domain and to get its HTTPS certificate, so it creates its records as DNS only. Records it reads as proxied are saved that way in the snapshot.

### Can the token change other domains in my account?

Not if you restrict it to one zone, as Cloudflare allows; other zones then return an error. Pilotiko recommends never granting all zones.

### Could my email go down during the cutover?

Pilotiko checks the MX record and mail aliases before changing anything. If email depends on the website's server, the cutover is blocked and a specific fix is proposed.

### What if I lose the token?

Cloudflare shows the secret only once. Create a new one with the same restrictions, paste it into Pilotiko, then delete the old one in Cloudflare.

### Can I undo a cutover?

Yes. The reverse plan restores the snapshot's records with their original value, TTL and proxy state.

### Do I need a paid Cloudflare plan?

Pilotiko only uses the DNS API and API tokens. We don't publish a list of compatible Cloudflare plans, so check that your account lets you create a token limited to one zone.

## Sources

1. Cloudflare Docs, « Create API token », https://developers.cloudflare.com/fundamentals/api/get-started/create-token/ (accessed on 2026-10-15)
2. Cloudflare Docs, « Proxy status », https://developers.cloudflare.com/dns/proxy-status/ (accessed on 2026-10-15)
3. Cloudflare Docs, « API reference: DNS records », https://developers.cloudflare.com/api/resources/dns/subresources/records/ (accessed on 2026-10-15)
4. LégisQuébec, « Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) », https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 (accessed on 2026-10-15)