Home 🤖 OTTO SEO 🔑 Create a Cloudflare API Token for OTTO

🔑 Create a Cloudflare API Token for OTTO

Last updated on Oct 29, 2026

🔍 Overview

To connect your website to OTTO through Cloudflare, create a Cloudflare user API token and provide it to Search Atlas. The token authorizes OTTO to configure the Cloudflare integration. Invalid tokens or insufficient permissions can cause connection errors. [Guide:641–655]

The provided Cloudflare API token is invalid or has insufficient permissions. Please check your token and ensure it has Workers and Zones permissions.

This guide shows you how to create a token with the right permissions and how to fix the error if it appears.

✅ Before You Start

  • You need a Cloudflare account that manages the DNS for your website.
  • Your domain must already be added to Cloudflare and show as Active.
  • Sign in as a Cloudflare user with access to your website’s account and zone and sufficient permissions to authorize the OTTO integration. [Cloudflare docs]
  • You need an API Token, not the Global API Key. These are different things, and the Global API Key will not work for this connection.

🛠️ Step-by-Step: Create the API Token

  1. Log in to your Cloudflare dashboard.
  2. Open https://dash.cloudflare.com/profile/api-tokens while signed in to Cloudflare. Use the user API Tokens page, not Account API Tokens. [Guide:650–655]
  3. In the left menu, click API Tokens.
  4. Click Create Token.
  5. Click Create Token and select the Edit Cloudflare Workers template. Then add Zone → DNS → Edit. Do not switch to Account API Tokens. [Guide:650–674]
  6. In Token name, enter something easy to recognize, such as Search Atlas OTTO.
  7. Under Permissions, retain the Workers Scripts, Workers Routes, and Workers KV Storage permissions supplied by the Edit Cloudflare Workers template, and add Zone → DNS → Edit. [Guide:660–674]
  8. Zone - Workers Routes - Edit
  9. Zone - Zone - Read
  10. Under Account Resources, choose Include and select the Cloudflare account that holds your website.
  11. Under Zone Resources, choose Include and then either All zones from an account or Specific zone and pick your domain.
  12. Leave Client IP Address Filtering empty. Restricting by IP can block the connection.
  13. For TTL, leave the dates blank so the token does not expire, or choose a far-future end date.
  14. Click Continue to summary, review the permissions, and click Create Token.
  15. Copy the token right away. Cloudflare shows it only once.

Note: If the OTTO connection screen lists any additional permissions, add those too. The list shown in the platform always takes priority.

🔗 Add the Token to OTTO

  1. Open your project in Search Atlas and go to the OTTO setup or Cloudflare connection screen.
  2. Paste the token into the API token field.
  3. Check that there are no extra spaces before or after the token.
  4. Click the button to connect or verify.

⚠️ Why You See the Invalid Token Error

This error almost always comes from one of these causes:

  • Missing Workers permission. The token does not include Workers Scripts (Account) or Workers Routes (Zone) with Edit access.
  • Missing Zone permission. The token cannot read your zone because Zone - Zone - Read is not added.
  • Wrong resource scope. The token is limited to a different account or a different domain than the one you are connecting.
  • Read instead of Edit. Permissions set to Read where Edit is needed.
  • Global API Key used by mistake. The Global API Key is not the same as an API Token.
  • Copy and paste problems. The token was cut off or has a space at the start or end.
  • Expired or deleted token. The token passed its end date or was rolled or deleted in Cloudflare.
  • IP restrictions. The token only works from specific IP addresses.

🧰 Troubleshooting Checklist

  1. In Cloudflare, go to My Profile and then API Tokens, and find your token.
  2. Click Edit and compare the permissions with the list in this article.
  3. Confirm the status is Active and that it has not expired.
  4. Check that Account Resources and Zone Resources include the right account and domain.
  5. Remove any IP address filtering.
  6. Save your changes. If you are unsure, use Roll to generate a new secret, or create a fresh token with the steps above.
  7. Copy the token again carefully and paste it into OTTO.
  8. Try the connection again.

💡 Tips for a Smooth Connection

  • Create a dedicated token for OTTO instead of reusing one from another tool.
  • Do not delete or roll the token after connecting, or OTTO will lose access.
  • If you manage several domains, use All zones from an account so you do not need a new token for each site.
  • Store the token somewhere safe, and never share it publicly.

💬 Need More Help?

If you still see the error after checking the steps above, we are happy to take a look. If you need further assistance, open the chat widget in the bottom-right corner of the platform and type human teammate to be instantly connected with a member of our team.