Connect PD Cloudflare DNS to the Cloudflare account holding the zones you intend to manage. The module uses your token for provider access; customers use the billing client area rather than receiving that credential.

Prepare the record-management token

1. In Cloudflare, open My Profile → API Tokens → Create Token.
2. Start with Edit zone DNS and review its permissions.
3. Include Zone / Zone / Read and Zone / DNS / Edit for the record-management workflow.
4. Restrict Zone Resources to the zones this integration should manage, or use wider coverage only when that is intended.
5. Review any expiry and applicable source-IP restriction, then create and store the token privately.

Cloudflare’s token-creation guide explains resource restrictions. If IP filtering is used, the calling address is your billing server’s outbound address, not the browser you use to administer it.

Add the provider

1. In WHMCS, open PD Modules → Cloudflare DNS → Providers → Add a provider.
2. Enter a recognisable provider name and the value in API token.
3. Choose Test connection and read its result.
4. After a successful test, choose Add provider.
5. Open Zones and confirm the intended account’s authorised zones appear.

The module reads provider records directly; adding this connection is not a migration of DNS authority or an instruction to change every domain’s nameservers.

Match optional actions to their permissions

A successful connection or existing-zone record edit does not prove permission for every optional action. Cache purge, redirects, email routing and zone deletion can need additional permissions. Grant those only for features you intend to use.

For creation of a new zone, review account/resource coverage and Cloudflare’s current Create Zone requirements. Do not treat a token limited to particular existing zones as evidence that a new zone is authorised.

Rotate and troubleshoot

Create the replacement, edit the saved provider, replace the token, test and save before revoking the old value. An invalid/expired token differs from an action-specific permission refusal. If only some zones appear, check the intended resource scope; do not expose unrelated zones simply to make the list longer.

Your hosting team should retain the provider name, original action time and redacted error while its Cloudflare administrator checks the exact refused action. Never include the token. Continue with zone assignment when you are ready to give a client access.

Check the provider connection

Your hosting team and Cloudflare administrator should compare the intended saved provider, token validity/expiry, authorised resources and billing server’s outbound address with the original connection or action-specific refusal. A passing connection check does not prove permission for every record write, new-zone creation or optional feature. Review the named refusal before widening scope or replacing a working credential. Do not include the token or expose unrelated zones to obtain a different list.

See the PD Cloudflare DNS WHMCS guide for related tasks, or explore the module.