# Set DNS with Cloudflare

If your domain is hosted at Cloudflare, you connect an API token once and the platform writes the A and CNAME records into your zone itself.

> Source: https://www.application-platform.com/en/docs/dns-cloudflare/

If your domain's DNS zone is hosted at [Cloudflare](https://www.cloudflare.com/), you connect an API token to your organization, and the platform writes the records from the domain detail into the zone. The manual procedure under [Configure DNS]({{< relref "domain-how-to" >}}) remains available, for example for domains with other providers.

## Create the token in Cloudflare

1. In Cloudflare, open **My Profile → API Tokens**. Alternatively, an account token works.
2. Create a token with the permissions **Zone → DNS → Edit** and **Zone → Zone → Read**. The platform needs no further rights, in particular no Global API Key.
3. Copy the token.

## Create the connection in the platform

1. Open [**Connections**]({{< relref "connections" >}}) in the sidebar and click **Add connection**.
2. Choose **Cloudflare**.
3. Paste the API token and save. The platform checks whether the token is valid.

An organization can have several Cloudflare connections. If a domain matches more than one zone, the platform uses the most specific one, for `shop.example.com` the zone `shop.example.com` if it exists, otherwise `example.com`.

## What the platform writes into the zone

The platform sets exactly the hosts from **Domains** as `A` or `CNAME` records once the assigned server has an address. It keeps the orange Cloudflare proxy switched off so that Let's Encrypt reaches the server directly. Every time you save a project, it aligns missing or differing records; the verification status appears in the **Status** column of the domain overview.

## If no check mark appears

If the platform reports the token as invalid, check the **Zone → DNS → Edit** and **Zone → Zone → Read** permissions in Cloudflare and update the connection. If no record shows up in Cloudflare, the domain is not in any zone the token is allowed to see; check the Cloudflare account and zone name. If the check mark is missing despite the record in Cloudflare, the DNS change still needs time, or the server has no known address yet.