Cloudflare
Anything in front of your traffic is a vendor with a very good view of it. Urengi reads the zones, the plan behind them and the workers and apps attached, so the edge of your stack is reviewed rather than assumed.
- Category
- Cloud & security
- Auth method
- Scoped API token
- Direction
- Read-only
- Sync frequency
- Daily
- Scopes requested
- 3
- Available on
- Growth and Enterprise
- Maintained by
- Urengi
What the Cloudflare integration does
Three reads about the layer every request passes through.
Zones and their plan
Each zone is recorded with the plan behind it, because what you are entitled to under an incident depends on which one you are paying for.
Workers are third-party code paths
Scripts running at the edge see requests before your origin does. Each one is listed against the zone it runs on.
Settings as evidence
TLS mode, WAF status and DNSSEC land on the review as recorded facts rather than as a screenshot in a folder.
Exactly what Urengi can see
Three read-only scopes on a token you scope to the zones you choose.
Urengi reads
- Zone names, plans and status
- Worker script names and routes
- TLS, WAF and DNSSEC settings
Urengi writes
- Nothing — this connection is read-only
Urengi never touches
- Request logs or any visitor data
- DNS record contents
- Certificates, keys or origin secrets
- Anything after you roll the token
Connect it in four steps
One authorisation, one field mapping, and a test sync you run yourself.
01
Authorise the connection
Open Cloudflare from this page and approve the scopes listed above — OAuth in a browser tab, or a scoped API key you paste. An admin approves them once.
02
Choose what syncs
Pick the projects, spaces or accounts Urengi should watch. Narrow is fine to start with; widening it later does not re-authorise anything.
03
Map your fields
Match owners, cost centres and tiers to what Urengi already tracks. Defaults arrive pre-filled from the first sync, so most teams change nothing.
04
Run a test sync
Pull one record and check it landed on the right review. The audit entry confirms the mapping before a real vendor is touched.
Your token, your rules.
Urengi stores the Cloudflare token encrypted at rest under a per-tenant key and never replays it outside the scopes you approved. Revoke the app in Cloudflare and every Urengi write stops within seconds — the audit log keeps the history, the connection simply ends.
Read the security statement- SOC 2 Type II
- audited annually
- Per-tenant keys
- no shared secrets
- Revocable in Cloudflare
- one click, no ticket
- EU or US residency
- chosen at signup