Use the module’s REST API for controlled monitoring or record automation. Its tokens are separate from the Cloudflare provider token saved under Providers. Keep them on trusted backends and grant only the read/write operations the integration needs.

Create an integration token

1. Open PD Modules → Cloudflare DNS → Maintenance → API access.
2. Create a named token for the specific integration.
3. Choose read for monitoring/listing, adding write only when that integration must change records.
4. Configure a source-IP allow-list when the caller has a stable outbound address.
5. Copy the token when shown and store it in the backend’s secret configuration.
6. Copy the installation’s endpoint URL from this panel rather than constructing a route from another platform’s example.

The API is administrative automation access to tracked zones. Do not hand a module-wide integration credential to an end customer as a substitute for their assigned client-area access.

Authenticate and read first

Use HTTPS and send Authorization: Bearer with the token. If the web server does not forward that header, the module also accepts X-Api-Token. Keep the secret out of URLs, browser scripts and request logs.

A GET with action=zones lists tracked zones. A GET with action=records and zone set to the intended domain reads its records. Check the actual returned zone before preparing any change; a provider-account zone and a tracked module zone are not interchangeable lists.

Prepare a record operation

Use POST with the documented action: addrecord, editrecord or delrecord. Supply the zone and the fields for that record type. An edit/delete uses recid obtained from the live records response; deletion also confirms the type and name. MX/SRV operations need the corresponding priority and service fields.

Start with a controlled zone and review the intended request. Read back the result after a write, and reconcile an uncertain response before retrying. A DNS mutation can affect a live service even if the calling application only reports a timeout.

Handle policy and errors

API writes still obey zone locks, content policies and protected managed records. Do not switch to an API token to bypass a client’s refused edit. 401 concerns authentication; 403 can concern scope or policy; 404 concerns a missing target; 429 requires backing off from the rate limit.

Rotate by creating the replacement, switching the integration, verifying its operation and revoking the old token. Review Activity for attributed write results, and keep secrets out of diagnostic attachments.

See the PD Cloudflare DNS Blesta guide for related tasks, or explore the module.