Cloudflare

Cloudflare does three jobs for a factory: it’s a deployment target (Workers and Pages), it manages DNS for the domains your products live on, and it feeds request stats and logs to your SRE seat.

Connect

Settings → Connectors → Cloudflare. Two ways in:

OAuth (recommended)

Click Connect, approve the scopes on Cloudflare’s own consent screen, and you’re done. If your login has access to more than one Cloudflare account, you’ll pick which one this factory uses at the end of the flow.

Sapient stores a rotating refresh token, sealed, and mints short-lived access tokens as needed. No long-lived credential of yours sits in our database, and revoking the grant in your Cloudflare dashboard cuts access immediately.

API token (fallback)

If OAuth isn’t available — a restricted org, or a token you’d rather scope by hand — create an API token in Cloudflare (My Profile → API Tokens) with the permissions you want to grant, and paste it. Same encryption, same behavior downstream; you just own the scoping.

What the factory does with it

• Deploys Workers and Pages projects as a deployment target, approval-gated like every other deploy.
• Manages DNS for domains you point at Cloudflare — records for a newly deployed product, and the verification records email and custom domains need.
• Reads stats and logs for the SRE seat: request volume, error rates, and the signal it needs to tell you a release went wrong.

Which of these actually work depends on the scopes you granted. Sapient records the granted scopes at connect time, so a capability gap shows up as a precise “this needs the X permission” rather than an opaque failure.

Troubleshooting

“Cloudflare OAuth is not configured.” OAuth isn’t enabled for this environment yet. Use the API token path.

A DNS or deploy action fails with a permissions error. The grant is missing a scope. Reconnect and approve the full set, or widen the API token’s permissions.

Multiple accounts and the wrong one got picked. Disconnect and reconnect; the account picker appears whenever the grant covers more than one account.

Removing

Remove the connection under Settings → Connectors, and revoke the grant in Cloudflare (My Profile → Authorized Apps) if you used OAuth. DNS records and deployed Workers stay exactly as they are — disconnecting stops Sapient from managing them, it doesn’t tear anything down.