This Driver generates a new subdomain for a domain that is managed in a Cloudflare Zone.

Property Description
Resource Type dns
Account Type cloudflare



Name Type Description
zone_id string The ID of the Cloudflare zone the record is in.
domain string The domain under which to specify the subdomain. For example,
proxied boolean [Optional] A boolean value specifying whether Cloudflare proxies this subdomain. Defaults to false.
ttl integer [Optional] An integer number of seconds that the DNS name should live for. Defaults to 1 which means “Default” in Cloudflare.




Zone Identifier

Cloudflare organises resources into “Zones”. You can find the Zone Identifier on the main dash page for the domain. It is at the bottom right under the heading Zone ID.

API Token

The Driver uses a Cloudflare API Token to add, update and remove DNS records. The token must have Zone.DNS edit permissions on the zone the subdomain should be set up in.

The token should be added as an account of type cloudflare.


In this example, we use the humanitec/dns-cloudflare Driver to provision new subdomains under for an app called cloudflare-dns-example-app.

First, the Resource Account containing the Cloudflare API Token must be created:

curl \
  -X POST \
  -H "Authorization: Bearer $HUMANITEC_TOKEN" \
  -H "Content-Type: application/json" \
  --data-binary '{
    "id": "cloudflare-example-account",
    "name": "Cloudflare Example Account",
    "type": "cloudflare",
    "credentials": {
      "token": "kji2b0masdlkfjbaslf-b28n"

Then following Dynamic Resource Definition should be added:

curl \
  -X POST \
  -H "Authorization: Bearer $HUMANITEC_TOKEN" \
  -H "Content-Type: application/json" \
  --data-binary '{
  "id": "dynamic-dns-cloudflare",
  "name": "Dynamic DNS via Cloudflare",
  "type": "dns",
  "criteria": [
      "app_id": "cloudflare-dns-example-app"
  "account_id": "cloudflare-example-account",
  "driver_type": "humanitec/dns-cloudflare",
  "driver_params": {
    "values": {
      "zone_id": "1ef520391d97ed73c38bc35dd8b570d0",
      "domain": "",
      "ttl": 1,
      "proxied": false
    "secrets": {
      "tls": {
        "tls.crt": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n",
        "tls.key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n"