Skip to main content

​
After this article

You will be able to connect Cloudflare to Lumos to sync users and roles, and optionally provision access. The integration supports a read-only mode and a provisioning mode.

​
Capabilities

Account creation in Cloudflare is invite-based. When Lumos creates an account, it sends a Cloudflare member invitation and the membership sits pending until the user accepts. Assigning a role before the invite is accepted fails, so first-time role assignment for a new member waits until the account is active.

​
Required plan and roles

  • Credentials: a Cloudflare API Token created from a custom token template, plus your Account ID.
  • Token permissions (read-only):
    • User → Memberships → Read
    • User → User Details → Read
    • Account → Access: Organizations, Identity Providers, and Groups → Read
    • Account → Account Settings → Read
  • Token permissions (provisioning): add these on top of the read set:
    • Account → Account Settings → Edit
    • User → Memberships → Edit

​
Read-only access vs provisioning

Is read-only possible? Yes. Create the API Token with only the four read permissions (User → Memberships → Read, User → User Details → Read, Account → Access: Organizations, Identity Providers, and Groups → Read, Account → Account Settings → Read) and the connection is read-only. What read-only requires. A custom Cloudflare API Token scoped to the four read permissions above, plus your Account ID. Follow the steps below to create the token and connect. What full provisioning requires. The same API Token with two additional Edit permissions on top of the read set, Account → Account Settings → Edit and User → Memberships → Edit. Watch out for. Switching from read-only to provisioning means editing the same token’s permissions (or issuing a new one), not reconnecting through a different card. Account creation in Cloudflare is invite-based, so a new member sits pending until they accept, and assigning a role before that happens fails until the next sync picks up the active account. The connector only manages account-wide roles, so members defined by a zone-scoped Domain Scoped Roles policy will reject role assignment.

​
Instructions

Phase 1: Create an API Token in Cloudflare
  1. Log into the Cloudflare dashboard and go to My Profile → API Tokens.
  2. Create a new API Token. When prompted with templates, select Create Custom Token.
  3. Add the permissions listed above (the read set for read-only, plus the Edit permissions for provisioning).
  4. Save the token value.
Phase 2: Find your Account ID
  1. Go to the Cloudflare dashboard. Once logged in, you land on a URL like https://dash.cloudflare.com/ACCOUNT_ID.
  2. The ACCOUNT_ID portion of that URL is your Organization Account ID.
Phase 3: Connect in Lumos
  1. Find the Cloudflare card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Enter your API Token and Account ID.
  3. Click Connect.

​
API Endpoints Used

​
Troubleshooting

Can’t connect the integration. Confirm the API Token carries all four read permissions, and that the Account ID matches the ACCOUNT_ID in your dashboard URL. For provisioning, the token also needs the two Edit permissions. Role assignment fails with 400 code 1001 “Invalid role assignments found”. The member is defined by a zone-scoped permission policy (Domain Scoped Roles) rather than account-wide roles. The connector manages account-wide roles only, so Cloudflare rejects the role update for policy-based members. A newly created account gets a 404 code 1003 “Member not found for account”. The role was assigned before the user accepted the Cloudflare invite. Wait for the user to accept, let the daily sync (or a manual sync) discover the active account, then the role assignment lands. Cloudflare access provisioned through OneLogin raises false “Automatic provisioning failed” error tasks. The access actually succeeded. Older behavior polled OneLogin for up to 15 seconds to confirm the app auto-assigned, and slow propagation timed out and created a spurious error task. A fix removed the hard failure, and existing stale error tasks can be safely dismissed from the task center.