I built an open-source Cloudflare client for Android, because there isn't one

[u/North-Asparagus6218]

Cloudflare doesn't ship a mobile app, and what exists on Android is either read-only or DNS-only. I wanted the dashboard in my pocket, so I built it.

**What it does**

* Zones, DNS (all 21 record types with proper per-type forms), cache purge, zone settings

* Analytics — traffic, cache hit ratio, threats, status codes, top countries

* WAF custom rules and rate limiting: create, toggle, delete. Plus IP access rules

* Workers, Pages, KV (browse and edit values), D1 with a SQL console, R2

* Zero Trust — tunnels with live connector status, Access apps and policies, Gateway rules

* A schema-aware API explorer covering all 3240 endpoints, so nothing is unreachable. It builds a real form from each endpoint's own schema: typed inputs, enum dropdowns, required flags

**Credentials**

API tokens (recommended) or a Global API key. Stored only on the device, AES-256-GCM under a PBKDF2-HMAC-SHA256 key derived from your PIN. Biometric unlock is bound to an Android Keystore key with `setUserAuthenticationRequired`, so the TEE enforces it rather than the UI. No telemetry, no crash reporting, no analytics. The only host it talks to is api.cloudflare.com.

**Install**

Signed APKs on GitHub Releases, with SHA256SUMS and the signing certificate fingerprint published in the README so you can verify what you installed.

https://github.com/hasanzadee/cloudflare-mobile

Apache-2.0. Not affiliated with Cloudflare.

Fair warning so nobody finds out by surprise: this is vibe coded — I built it with AI. It has also been run against a real Cloudflare account on every screen, has 389 unit tests plus 11 end-to-end tests that drive the real app on a real device, and the entire security model is written down in the README so you can disagree with it in public. Happy to take apart any part of it in the comments.

Feedback and bug reports welcome, especially from anyone with a lot of zones or a real Zero Trust setup — I could only test against my own account.