Cloudflare

The Cloudflare extension connects your Cloudflare accounts to Kunobi through the Cloudflare API. Add an account with an API token and you can browse its zones, DNS records, Workers and Worker routes, tunnels, load balancers with their pools and monitors, and R2 buckets - and act on zones directly: create, edit and delete DNS records, purge the cache, and toggle development mode. Each zone also gets a traffic analytics panel (requests, bandwidth, visitors, threats).

A single API token may span several Cloudflare accounts - Kunobi discovers all of them and aggregates their resources, tagging the rows with the account they belong to. You can also add several connections (one per token) and switch between them.

Cloudflare is a Pro feature - without a Pro license the Sources workspace is replaced by an "Account sources" upgrade notice and the data views show "Cloudflare requires a Pro license". See Plans & Pro.

Setup

Install the Cloudflare extension from Settings → Extensions (see Extensions). It starts automatically. If you open a Cloudflare view while the extension isn't running, Kunobi shows a "Cloudflare extension required" notice instead.
Create an API token in the Cloudflare dashboard (My Profile → API Tokens). It must be an API Token - the legacy Global API Key won't work, since Kunobi authenticates with the token alone. Give it read access to the products you want to browse (zones, DNS, Workers, load balancing, R2, analytics) and edit access to DNS, cache purge, and zone settings if you want to use the write actions.
Add the account as described below. The machine running Kunobi needs HTTPS access to api.cloudflare.com.

Managing Accounts

Click Sources in the left navigation bar.
Open the workspace selector in the sidebar (press W) and pick Cloudflare Accounts.

The table lists your connections with columns Account (the connection name with its Cloudflare account id underneath), Status, and Last check (the result of the latest test or connect from this session). Filter it with ⌘F (Ctrl+F). Select a row and press o or y for the Overview and YAML sidebar tabs with the full record.

Keyboard shortcuts are macOS-first on this page; on Windows/Linux replace ⌘ with Ctrl and ⇧ with Shift.

The Status column tells you where each connection is in its lifecycle:

Status	Meaning
`connected`	Activated; the token verified and the zone list loaded.
`connecting`	Activation in progress.
`error`	The last activation failed - bad token or Cloudflare unreachable.
`disconnected`	No longer active.
`unknown`	Not activated since the extension started.

Adding an Account

Press Add (n) and fill in the form:

Field	Notes
Name	A label for this connection. Required.
Token	The Cloudflare API token. Required. It goes to your OS keychain, never to a config file.

Test Connection in the dialog verifies the token against the Cloudflare API without saving anything.

Adding saves the connection without connecting - but when no other connection is active yet, Kunobi immediately activates the new one for you, so your first account is browsable right away. If that automatic activation fails (for example, the token is invalid), the connection is still saved - fix the token and activate manually.

Testing, Editing & Removing

With a row selected:

Test (t) - verifies the stored token against the Cloudflare API. The result appears in the Last check column: Testing..., then OK or Failed, with the message in a tooltip.
Edit (e) - change the name or paste a new token; leaving Token blank keeps the stored one (the dialog's Test Connection then verifies the stored token). A rotated token is picked up the next time the connection is activated - press Activate (c) after saving to reconnect with it.
Remove (Backspace) - after a confirmation ("Remove account?"), the connection is removed along with all its collected data, and its token is deleted from the keychain.

The Active Account

Activate (c) connects a connection and makes it the active one:

Kunobi verifies the token, fetches the zone list, and discovers every Cloudflare account the token can reach - all of them feed the data views.
The data views always show the active connection's resources. Data already fetched for other connections is kept in memory, so switching back is instant.
The active connection shows in the connection indicator in the status bar at the bottom of the app, where you can also switch it.

The selection survives restarts; a sole connection is activated automatically, but with several connections Kunobi never guesses - you pick.

Browsing Cloudflare Data

Open the Kubernetes data page, open the workspace selector (press W), and pick Cloudflare Accounts. The sidebar lists ten resource kinds - filter them with the box at the top. Every view except Accounts has an Account column showing which Cloudflare account each row belongs to:

Zones - your domains: name, status (Cloudflare's zone status, e.g. active), whether the zone is paused, plan, and development mode. Refreshed every 30 seconds in the background. From a selected zone you can also jump to its Worker Routes and Load Balancers through the command palette.
DNS Records - the records of one zone: type, name, content, proxy status (proxied or DNS only), and TTL (Auto for Cloudflare-managed). This view is scoped to a zone - select a zone and drill into it (press Enter or double-click); opened directly from the sidebar it stays empty.
Workers - Worker scripts across all accounts: name, usage model, compatibility date, last modified.
Worker Routes - the URL patterns binding Workers to zones: pattern, script, enabled. Also zone-scoped - drill in from a zone (via the command palette).
Tunnels - Cloudflare Tunnels: name, status, number of active connections, creation time.
Load Balancers - per-zone load balancers across all zones: name, zone, enabled, proxied, steering policy, pool count. Drilling into one opens its fallback pool.
Pools - load-balancer origin pools: name, enabled, origin count, minimum origins, monitor. Drilling into one opens its health monitor.
Monitors - load-balancer health monitors: type, description, method, path, interval, timeout.
R2 Buckets - object storage buckets: name, location, storage class, creation date.
Accounts - every Cloudflare account the active token can reach: name, account id, type.

Zones and accounts are fetched when the connection activates; DNS records when you drill into a zone; the other kinds when you open their view. If Cloudflare rejects the fetch for every account (or, for the zone-scoped kinds, every zone) - for example, R2 isn't enabled, or the token lacks a permission - the view shows the error message Cloudflare returned; if only some succeed, their rows are shown. See Drilldown for how drilling, breadcrumbs, and the kind filter work.

Resource Details

Selecting a row opens detail tabs in the sidebar: an Overview with the kind's key fields (accounts get a generic field list) and a read-only YAML tab with the raw record. Zones, load balancers, and pools have extra tabs:

Zone → Analytics - traffic totals for the zone over a selectable period (24h, 7d, 30d): requests with the cache-hit share, bandwidth with the cached share, unique visitors with page views, and threats blocked. Fetched when the tab opens.
Zone → Routes - the Worker routes bound to this zone, each with its pattern, script, and enabled state.
Load Balancer → Pools - the default pool ids and the fallback pool.
Pool → Monitor & Origins - the attached monitor and each origin with its name and address.

DNS & Zone Actions

The row actions appear in the action bar with a matching row selected, in the command palette, and on their keyboard shortcuts; Refresh Cloudflare Zones lives in the command palette only. All are Pro-gated like the rest of the extension.

Create DNS Record

With a zone selected, press ⌘⇧N (Ctrl+Shift+N). Pick the record type (A, AAAA, CNAME, MX, TXT, NS, SRV, CAA) and fill in name and content - the content field hints the expected format per type. TTL offers Cloudflare's presets (Auto, 1 min, 5 min, 1 hour, 1 day); MX and SRV records get a Priority field; A, AAAA and CNAME records get a Proxied (orange cloud) checkbox.

Edit DNS Record

With a DNS record selected, press ⌘⇧E (Ctrl+Shift+E). Same form, but the record type is fixed - Cloudflare requires deleting and recreating a record to change its type.

Delete DNS Record

With a DNS record selected, press ⌫ (Backspace). The confirmation requires typing the record's name before Delete record enables - this cannot be undone.

The records list refreshes immediately after each create, edit, or delete.

Purge Cache

With a zone selected, press ⌘⇧P (Ctrl+Shift+P). Two modes:

Purge everything - removes all cached content for the zone. Destructive for your cache-hit rate, so it requires typing the zone name before the button enables.
Purge specific URLs - up to 30 exact URLs, one per line.

Toggle Development Mode

With a zone selected, press ⌘⇧M (Ctrl+Shift+M). Development mode bypasses Cloudflare's cache so you see origin changes immediately; Cloudflare switches it off automatically after three hours. The zone's Dev mode column updates right away.

Refresh Cloudflare Zones

From the command palette, no selection needed - asks the extension to re-fetch the active connection's zone list on demand.

Security

Tokens never touch the config file. API tokens are stored in your operating system's keychain (macOS Keychain, Windows Credential Manager, or the Linux Secret Service), one entry per connection. Removing a connection deletes its entry. Tokens are never logged and never displayed anywhere in the app.
All communication goes to api.cloudflare.com over HTTPS. Prefer narrowly scoped API tokens: the extension works with exactly the permissions you grant, and read-only tokens are enough if you don't use the write actions.

Configuration File

Connection definitions are persisted in a TOML file (read at startup, rewritten whenever you change something in the app):

macOS: ~/Library/Application Support/<app-id>/extensions/cloudflare/config.toml
Linux: ~/.local/share/<app-id>/extensions/cloudflare/config.toml
Windows: %APPDATA%\<app-id>\extensions\cloudflare\config.toml

where <app-id> matches your Kunobi variant (for example ninja.kunobi.desktop).

# active_connection_id = "..."   # the active connection - managed by the app

[[connections]]
id = "6f1c9f0a-..."              # generated when the connection is added
name = "Production"
# account_id = "..."             # discovered on first connect - managed by the app

There is no token field - tokens live in the keychain, keyed by the connection's id. Leave the managed fields alone.

Polling Behavior

Once activated, a connection's zone list refreshes every 30 seconds in the background - switching the active connection does not stop the previous one's refresh; removing the connection does. Everything else is fetched on demand (opening a view or detail tab, drilling into a zone, switching the analytics period).
API requests rate-limited by Cloudflare are retried automatically up to three times before an error surfaces; analytics queries are not retried.
Data is a live snapshot per connection - no history is recorded. Deactivating or switching connections keeps the fetched data in memory; removing a connection deletes its data.

Troubleshooting

"no active Cloudflare connection" - the data views and zone actions work against the active connection. Select the connection on the Sources page and press Activate (c).

Account added but the data views are empty - the automatic first activation failed, most likely an invalid or expired token. Edit the connection, paste a fresh token, and activate.

"Token status is 'disabled', expected 'active'" (or similar) - the token exists but is disabled or expired; re-enable or re-issue it in the Cloudflare dashboard.

A view shows a Cloudflare error instead of rows - Cloudflare rejected the fetch everywhere, typically because the product isn't enabled (R2 is opt-in) or the token lacks that product's read permission. The message shown is Cloudflare's own.

DNS Records or Worker Routes open empty from the sidebar - both views are zone-scoped by design. Drill in from a zone instead.

The Analytics tab says "Analytics unavailable" - the fetch failed, most commonly because the token can't read the zone's analytics. Grant the token Analytics read access; the tab shows Cloudflare's error message alongside.

Limitations

Write operations cover DNS records, cache purging, and development mode. Everything else - zones, Workers, tunnels, load balancers, pools, monitors, R2 - is read-only.
One connection is active at a time; the data views show that connection's accounts.
The DNS Records view holds one zone's records at a time (the zone you drilled into).
Cache purge supports "everything" or up to 30 exact URLs per request - no purge by tag, hostname, or prefix.
Analytics are zone-wide totals over three fixed periods; no time series, no per-path breakdown.
The zone refresh interval is fixed; there is no per-connection polling configuration.