> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/integrations/resource-integrations/cloudflare.md).

# Cloudflare

This page documents how to install P0 for a Cloudflare account so you can manage just-in-time access to Cloudflare account roles. Users request a role, and P0 assigns it to their Cloudflare user when access is approved and removes it when access expires.

{% hint style="warning" %}
The Cloudflare integration is in preview. Functionality and configuration may change.
{% endhint %}

P0 manages Cloudflare roles through Cloudflare's SCIM 2.0 API. P0 assigns a role when a request is approved and removes it when access expires.

### Before you begin

Cloudflare's SCIM API requires an Enterprise plan, and you need Super Administrator access to the Cloudflare account to complete these steps. Gather two values from Cloudflare:

* **Account ID** — the identifier of the Cloudflare account you want P0 to manage. Find it on the account's overview page in the Cloudflare dashboard, or follow Cloudflare's [Find your account and zone IDs](https://developers.cloudflare.com/fundamentals/account/find-account-and-zone-ids/) guide.
* **SCIM API token** — a Cloudflare API token that grants P0 access to the account's SCIM API.

Create an [account-owned API token](https://developers.cloudflare.com/fundamentals/api/get-started/account-owned-tokens/) so the token stays tied to the account rather than an individual user:

1. In the Cloudflare dashboard, go to **Manage Account** > **Account API Tokens**.
2. Select **Create Token**, then create a custom token.
3. Add the **SCIM Provisioning** permission and set its access to **Edit**. P0 refers to this permission as **Account SCIM Provisioning**.
4. Under **Account Resources**, select the account you want P0 to manage.
5. Create the token, then copy its value. You provide it to P0 in the next section.

For the full procedure, see Cloudflare's [Set up SCIM provisioning](https://developers.cloudflare.com/fundamentals/account/account-security/scim-setup/) guide.

{% hint style="info" %}
P0 maps each requestor to a Cloudflare user by email address. Every user who requests Cloudflare access must already exist as a Cloudflare user in the account whose email matches their P0 identity. P0 assigns roles to existing users; it does not create Cloudflare users.
{% endhint %}

### Set up the Cloudflare integration

1. Open the P0 dashboard at [p0.app](https://p0.app) and log in to your organization.
2. In the sidebar, click **Integrations**. Under **Resources**, click **Cloudflare**.
3. Select the **Role management** component.
4. In the **Account** field, enter your Cloudflare account ID.
5. In the **SCIM API token** field, enter the Cloudflare API token you created.
6. Click **Next** to finish.

When you finish installation, P0 validates the credentials against the Cloudflare SCIM API. If validation fails, confirm that the account ID is correct and that the API token has the **SCIM Provisioning** permission set to **Edit**.

{% hint style="success" %}
You are ready to make just-in-time requests for Cloudflare roles with P0. See [Requesting Cloudflare access](/integrations/resource-integrations/cloudflare/requesting-access.md).
{% endhint %}

### What P0 grants

P0 grants Cloudflare **account roles**. A single request can include one or more roles. P0 lists the roles available in your Cloudflare account, so users select from your existing roles. Roles appear under their plain names, such as **Administrator** or **Read Only**.

To grant least-privileged access, make only the roles a user needs available through P0.

When access expires, or when a user relinquishes it early, P0 removes the granted role from the user but keeps the user in the Cloudflare account.

### Limitations

* The integration is in preview.
* P0 grants Cloudflare account roles only.
* Cloudflare's SCIM API requires an Enterprise plan.
* Each requestor must already exist as a Cloudflare user in the account whose email matches their P0 identity.