Docs Collections Updates & Release Notes

You can now assign granular, resource-scoped roles for Cloudflare Gateway firewall policies and Zero Trust lists. Administrators can delegate access to specific policy types or list management without granting account-wide or product-wide control.

What is new

When you add a member or create a permission policy, the following resource-scoped roles are now available:

Role Description Zero Trust Gateway Firewall Policies Admin Can view and edit all Gateway firewall policies, including DNS, HTTP, and Network policies. Zero Trust Gateway DNS Policies Admin Can view and edit Gateway DNS policies. Zero Trust Gateway HTTP Policies Admin Can view and edit Gateway HTTP policies. Zero Trust Gateway Network Policies Admin Can view and edit Gateway Network policies. Zero Trust Gateway Egress Policies Admin Can view and edit Gateway Egress policies. Zero Trust Gateway Resolver Policies Admin Can view and edit Gateway Resolver policies. Zero Trust Gateway Policies Admin Can view and edit all Gateway policies. Zero Trust Gateway Policies Read Can view all Gateway policies. Zero Trust Gateway Read Only Can view all Gateway resources. Zero Trust DNS Locations Admin Can view and edit DNS locations. Zero Trust Proxy Endpoints Admin Can view and edit Gateway Proxy Endpoints. Zero Trust Account Lists Admin Can view and edit all Gateway and Access lists. Zero Trust Account Lists Read Can view all Gateway and Access lists.

These roles allow you to:

• Grant a network engineer write access to Network policies only, without exposing DNS or HTTP policy configuration.
• Allow a security analyst to view all Gateway policies in read-only mode for auditing purposes.
• Delegate list management to a team that maintains block and allow lists without giving them access to policy configuration.

You can also now assign Resource-scoped roles. These roles are complementary to existing account-level roles, and allow you to grant access to a specific resource, like an individual Gateway policy or Cloudflare One list. Existing account-level roles continue to work. A member with the Cloudflare Gateway or Cloudflare Zero Trust role retains full access to all Gateway resources. This ensures backward compatibility for existing automation and API tokens.

Get started

• Review the resource-scoped roles on the Cloudflare role reference.
• Learn how to create permission policies that use these roles.

Original source

Pay-as-you-go customers can now view billable usage and create budget alerts directly from the product overview pages for Workers & Pages, D1, R2, Workers KV, Queues, Vectorize, Durable Objects, and Containers. A new sidebar widget shows current-period spend and the billing cycle date range, alongside a button to create a budget alert.

The widget pulls from the same data as the Billable Usage dashboard and aligns to your billing cycle (or the current day on Free plans), so the numbers match your invoice. Enterprise contract accounts are not yet supported.

Selecting Create budget alert opens the budget alert flow inline so you can set a dollar threshold in the same place you are reviewing usage. Budget alerts apply to your total account-level spend across all products, not just the product page you create them from.

For more information, refer to the Usage-based billing documentation.

Original source

Today we are launching self-managed OAuth, enabling developers to build third-party applications that integrate with Cloudflare via OAuth. This provides a more secure, user-friendly, and manageable alternative to API tokens.

OAuth lets third-party applications act on behalf of a user to access their Cloudflare account. For example, after a user grants consent, Wrangler can deploy Workers into that account.

What is new

Cloudflare Developers can now create and manage their own OAuth applications to integrate with Cloudflare.

Create an application

To create an application, go to Manage account > OAuth clients in your account on the Cloudflare dashboard.

Select limited scopes

If you have used an API token to call Cloudflare APIs, OAuth client scopes will look familiar. Select only the scopes your application needs during application creation, and include that scope list when sending users to Cloudflare for consent.

Users can review the requested scopes before they consent.

Apps for both private and public use

Applications start with private visibility. Private applications can only be used by members of the account where the application was created.

To make an application available to any Cloudflare user, complete the prerequisites for public visibility.

For more information, refer to client visibility.

Client domain verification

Before an application can be made public, you must verify the client domain. Domain verification helps users confirm that the application owner controls the domain shown on the consent page.

After verification, users see a verified badge on the consent page.

For more information, refer to domain verification.

Learn more

For more information, refer to OAuth clients.

Original source

You can now scope Cloudflare permissions to individual Cloudflare Tunnel instances and Cloudflare Mesh nodes. Administrators can delegate access to specific Tunnels or Mesh nodes without granting account-wide control over private networking.

When you add a member or create a permission policy, the resource picker now lists Cloudflare Tunnel instances and Cloudflare Mesh nodes as scopable resource types. You can:

• Grant a read-only role on a single Cloudflare Tunnel instance to a support operator for log streaming and diagnostics without exposing other Tunnels or destructive actions.
• Grant a write role on a specific Cloudflare Mesh node to an application team without giving them access to the rest of your private network.
• Scope a single policy to one or many Tunnels and Mesh nodes at once.

Granular permissions are a parallel layer to existing account-level roles — they do not replace them.

• Existing account-level roles continue to work. A member with Cloudflare Access or Cloudflare Zero Trust retains write access to every Tunnel and Mesh node in the account. This ensures backward compatibility for existing automation and tokens.
• Granular permissions are additive. For any API request on a specific Tunnel or Mesh node, access is granted if the principal has either the account-level role or a granular permission for that resource.
• Resource enumeration is authorization-aware. Listing endpoints (GET /accounts/{id}/cfd_tunnel, GET /accounts/{id}/warp_connector) return only the resources the principal has at least read access to.

Get started:

• Configure granular permissions for Cloudflare Tunnel.
• Configure granular permissions for Cloudflare Tunnel and Cloudflare Mesh in Cloudflare One.
• Review the resource-scoped roles on the Cloudflare role reference.

Original source

You can now scope Cloudflare permissions to individual Cloudflare Tunnel instances and Cloudflare Mesh nodes. Administrators can delegate access to specific Tunnels or Mesh nodes without granting account-wide control over private networking.

What is new

When you add a member or create a permission policy, the resource picker now lists Cloudflare Tunnel instances and Cloudflare Mesh nodes as scopable resource types. You can:

• Grant a read-only role on a single Cloudflare Tunnel instance to a support operator for log streaming and diagnostics — without exposing other Tunnels or destructive actions.
• Grant a write role on a specific Cloudflare Mesh node to an application team — without giving them access to the rest of your private network.
• Scope a single policy to one or many Tunnels and Mesh nodes at once.

How it works

Granular permissions are a parallel layer to existing account-level roles — they do not replace them.

• Existing account-level roles continue to work. A member with Cloudflare Access or Cloudflare Zero Trust retains write access to every Tunnel and Mesh node in the account. This ensures backward compatibility for existing automation and tokens.
• Granular permissions are additive. For any API request on a specific Tunnel or Mesh node, access is granted if the principal has either the account-level role or a granular permission for that resource.
• Resource enumeration is authorization-aware. Listing endpoints (GET /accounts/{id}/cfd_tunnel, GET /accounts/{id}/warp_connector) return only the resources the principal has at least read access to.

Get started

• Configure granular permissions for Cloudflare Tunnel.
• Configure granular permissions for Cloudflare Tunnel and Cloudflare Mesh in Cloudflare One.
• Review the resource-scoped roles on the Cloudflare role reference.

Original source

You can now navigate, switch context, and take common actions in the Cloudflare dashboard without leaving your keyboard. Press ? anywhere to see the full list. Keyboard shortcuts can be disabled by visiting your profile settings ↗ profile settings ↗.

Navigate

Shortcut - Action

g h - Go to Home
g a - Go to account overview
g z - Go to zone overview
g p - Go to your profile
g w - Go to Workers & Pages
g o - Go to Zero Trust
g b - Go to billing
g 1 – g 5 - Go to a recent or pinned item (by position in sidebar)
t → - Move to the next tab
t ← - Move to the previous tab
p → - Move to the next page of a table
p ← - Move to the previous page of a table

Take action

Shortcut - Action

/ - Open quick search
? - Show keyboard shortcuts
s a - Switch account
s z - Switch zone
s . - Star or unstar the current zone
p . - Pin or unpin the current page
t s - Toggle the sidebar open or closed
t m - Expand or collapse all sidebar menus
t a - Toggle Ask AI sidebar
d . - Toggle dark mode
c u - Copy the current URL
c d - Copy a deep link URL

Original source

You can now pay for Cloudflare services directly from your bank account using Instant Bank Payments via Link.

What changed

Link now supports bank account payments in addition to cards. If you have a bank account saved in Link, it appears as a payment option at checkout. If not, you can connect one during the checkout flow.

How to use it

1. During checkout, select your bank account from your saved Link payment methods.
2. Confirm the payment.

After your first Link authentication, your bank account is available for future purchases without re-entering details.

Who is eligible

Instant Bank Payments via Link is available to US-based self-serve accounts across all Cloudflare products. Your existing cards remain available at checkout.

Bank-based Link payments appear in your billing history with the payment method shown as link and last four digits as 0000. For details, refer to the Instant Bank Payments via Link documentation.

Original source

The Support button in the dashboard global navigation header now takes you directly to the Cloudflare Support Portal ↗, eliminating the previous dropdown menu.

This change ensures that when you need help, you spend less time navigating the UI and more time getting the answers you need.

What changed?

Previous behavior: Selecting ? Support opened a dropdown menu with various links (Help Center, Cloudflare Community, etc.).

New behavior: Selecting Support immediately redirects your current tab to the Support Portal.

To learn more about the resources available to you, refer to the Cloudflare Support documentation ↗.

Original source

Resource Tagging is now in public beta and rolling out to all Cloudflare accounts over the coming days. You can attach custom key-value metadata to your Cloudflare resources and query across your entire account to find what you need.

What's included

• Broad resource type support — Tag zones, custom hostnames, Cloudflare Tunnels, Workers scripts, D1 databases, R2 buckets, KV namespaces, Durable Objects, Queues, Stream videos, Images, Access applications, Gateway rules, AI Gateways, and more. Refer to the full list of supported resource types.
• Powerful filtering — Query tagged resources using AND/OR logic, negation, and key-only matching. Combine up to 20 filters per query to build precise resource views.
• Account and zone-level endpoints — Full CRUD operations across both scopes.
• Token-based authentication — Tagging supports Account Owned Tokens that persist independently of individual users, so your automation keeps running through credential rotations and team changes.
• Flexible role support — Super Administrators, Workers Admins, and Tag Admins can all manage tags.

API-first by design

The API is the primary interface for Resource Tagging and the recommended path for all workflows — scripting tag assignments, building CI/CD pipelines, or integrating with your infrastructure-as-code toolchain.

Dashboard UI

You can also view and manage tagged resources directly in the Cloudflare dashboard. Navigate to Manage Account > Resource Tagging to see all tagged resources across your account, filter by resource name or tag, and add or edit tags inline.

What's coming next

In future releases, expect support for additional resource types across the Cloudflare platform, tag-based access control policies for scoping user permissions to tagged resources, billing and usage attribution by tag for breaking down costs by team, project, or environment, and Terraform provider support for managing tags declaratively.

Current limitations

• PUT replaces all tags on a resource (no partial update). Use the GET, merge, PUT workflow to modify individual tags safely.
• DELETE removes all tags from a resource. To remove a single tag, PUT the remaining tags back.
• Querying tags for a resource that has never been tagged returns 500 instead of 404. This is a known beta limitation.

To get started, refer to the Resource Tagging documentation.

Original source

Cloudflare-generated 5xx error responses now return structured JSON and Markdown when agents request them, matching the format already available for 1xxx errors. Responses follow RFC 9457 (Problem Details for HTTP APIs) and include a Retry-After HTTP header on retryable codes.

Changes

5xx coverage

Ten Cloudflare-generated error codes (500, 502, 504, 520-526) now serve structured responses. These are errors Cloudflare itself generates when it cannot reach or understand the origin server. Origin-generated 5xx responses that Cloudflare passes through are not affected.

Fault attribution

The error_category field tells agents where the fault lies:

• origin (502, 504, 520-524) — the origin server is responsible. Transient; retry with the backoff in retry_after.
• cloudflare (500) — Cloudflare's fault, not the website or the request. Short retry.
• ssl (525, 526) — the origin's TLS configuration is broken. Do not retry.

Retry-After header

Retryable codes (500, 502, 504, 520-524) include a Retry-After HTTP header matching the retry_after body field. Non-retryable codes (525, 526) do not include the header.

Negotiation behavior

Request header sent | Response format

Accept: application/json | JSON (application/json content type)

Accept: application/problem+json | JSON (application/problem+json content type)

Accept: application/json, text/markdown;q=0.9 | JSON

Accept: text/markdown | Markdown

Accept: text/markdown, application/json | Markdown (equal q, first-listed wins)

Accept: / | HTML (default)

Availability

Available now for all zones on all plans.

Get started

Get JSON response for error 522:

Check presence of the Retry-After HTTP header associated with the JSON response for error 521:

References

• RFC 9457 — Problem Details for HTTP APIs
• Cloudflare 5xx error documentation

Original source

A new Network Overview page in the Cloudflare dashboard gives you a single starting point for network security and connectivity products.

From the Network Overview page, you can:

• Connect resources with Cloudflare Tunnel - Create tunnels to connect your infrastructure to Cloudflare without exposing it to the public Internet.
• Monitor traffic with Network Flow - Get real-time visibility into traffic volume from your routers.
• Configure Address Maps - Map dedicated static IPs or BYOIP prefixes to specific hostnames.
• Explore Magic Transit and Cloudflare WAN - Set up DDoS protection for your networks and connectivity for your branch offices and data centers.

To find it, go to Networking ↗ in the dashboard sidebar.

If you already use Magic Transit, Cloudflare WAN, or other Cloudflare network services products, your existing experience is unchanged.

Original source

Pay-as-you-go customers can now monitor usage-based costs and configure spend alerts through two new features: the Billable Usage dashboard and Budget alerts.

Billable Usage dashboard

The Billable Usage dashboard provides daily visibility into usage-based costs across your Cloudflare account. The data comes from the same system that generates your monthly invoice, so the figures match your bill.

The dashboard displays:

• A bar chart showing daily usage charges for your billing period
• A sortable table breaking down usage by product, including total usage, billable usage, and cumulative costs
• Ability to view previous billing periods

Usage data aligns to your billing cycle, not the calendar month. The total usage cost shown at the end of a completed billing period matches the usage overage charges on your corresponding invoice.

To access the dashboard, go to Manage Account > Billing > Billable Usage.

Budget alerts

Budget alerts allow you to set dollar-based thresholds for your account-level usage spend. You receive an email notification when your projected monthly spend reaches your configured threshold, giving you proactive visibility into your bill before month-end.

To configure a budget alert:

1. Go to Manage Account > Billing > Billable Usage.
2. Select Set Budget Alert.
3. Enter a budget threshold amount greater than $0.
4. Select Create.

Alternatively, configure alerts via Notifications > Add > Budget Alert.

You can create multiple budget alerts at different dollar amounts. The notifications system automatically deduplicates alerts if multiple thresholds trigger at the same time. Budget alerts are calculated daily based on your usage trends and fire once per billing cycle when your projected spend first crosses your threshold.

Both features are available to Pay-as-you-go accounts with usage-based products (Workers, R2, Images, etc.). Enterprise contract accounts are not supported.

For more information, refer to the Usage based billing documentation.

Original source

OAuth allows third-party applications to access your Cloudflare account on your behalf — like when Wrangler deploys Workers or when monitoring tools read your analytics. You now have granular control over which accounts these applications can access, plus the ability to revoke access anytime.

What's new

Choose which accounts to authorize

When authorizing an OAuth application, you can now select specific accounts instead of granting access to all your accounts:

• Account-by-account selection — Choose exactly which accounts the application can access
• "All accounts" option — Still available for trusted tools like Wrangler

This gives you precise control who can access your data.

Clear consent screens

The OAuth consent screen now shows:

• What the application can access — Explicit list of permissions being requested
• Who created the application — Application owner and contact information
• Which accounts you're authorizing — Checkboxes for account selection

Revoke access anytime

Manage authorized OAuth applications from your profile:

• See all connected apps — View every OAuth application with access to your accounts
• Review permissions and scope — Check what each application can do and which accounts it can access
• Revoke instantly — Remove access with one click when you no longer need it

To manage your OAuth applications, navigate to Profile > Access Management > Connected Applications ↗.

Why this matters

These updates give you:

• Granular control — Authorize apps per-account instead of all-or-nothing
• Transparency — Know exactly what you're authorizing before you consent
• Security — Limit blast radius by restricting access to only necessary accounts
• Easy cleanup — Revoke access when applications are no longer needed

Learn more

Read more about these improvements in our blog post: Improving the OAuth consent experience ↗ .

Original source

Cloudflare API tokens now include identifiable patterns that enable secret scanning tools to automatically detect them when leaked in code repositories, configuration files, or other public locations.

What changed

API tokens generated by Cloudflare now follow a standardized format that secret scanning tools can recognize. When a Cloudflare token is accidentally committed to GitHub, GitLab, or another platform with secret scanning enabled, the tool will flag it and alert you.

Why this matters

Leaked credentials are a common security risk. By making Cloudflare tokens detectable by scanning tools, you can:

• Detect leaks faster — Get notified immediately when a token is exposed.
• Reduce risk window — Exposed tokens are deactivated immediately, before they can be exploited.
• Automate security — Leverage existing secret scanning infrastructure without additional configuration.

What happens when a leak is detected

When a third-party secret scanning tool detects a leaked Cloudflare API token:

1. Cloudflare immediately deactivates the token to prevent unauthorized access.
2. The token creator receives an email notification alerting them to the leak.
3. The token is marked as "Exposed" in the Cloudflare dashboard.
4. You can then roll or delete the token from the token management pages.

Supported platforms

• GitHub Secret Scanning — Automatically enabled for public repositories

For more information on token formats and secret scanning, refer to API token formats.

Original source