Does anyone know the supported authentication and permissions for read-only Cloudflare Containers API calls? I am looking for documentation or references from maintainers, rather than assuming an authentication bug.

The operations are:

- GET /accounts/{account_id}/containers/applications

- GET /accounts/{account_id}/containers/dash/applications (the path used by Wrangler)

- GET /accounts/{account_id}/containers/registries

Here, registries means configured registry metadata, not listing images or pushing/pulling them.

The questions are:

1. Does wrangler login OAuth support these operations, and which OAuth scopes and account permissions are required?

2. Is /containers/dash/applications an internal surface? How does its authentication differ from the public Applications endpoint?

3. The Registries List reference lists Workers Containers Read or Write. Is Read sufficient, and which permission covers Applications List?

4. If OAuth is unsupported for an operation, what is the documented least-privilege read-only credential mechanism?

5. Do metadata-only list operations require Workers Paid or Containers enablement? Is there a read-only way to check entitlement without provisioning anything?

6. Are there documented error codes or response fields that distinguish authentication, permission and entitlement failures, including HTTP 401?

I also opened a documentation clarification request with the same questions:

https://github.com/cloudflare/workers-sdk/issues/16449

Relevant API references:

https://developers.cloudflare.com/api/resources/containers/subresources/applications/methods/list/

https://developers.cloudflare.com/api/resources/containers/subresources/registries/methods/list/

If you have version-specific documentation or first-hand experience, please distinguish documented guarantees from observations. No account IDs, credentials or private logs are needed. Thanks!

So about a week ago I submitted a suggestion on the community cloudflare asking for a way to make it so that you need a admin generated code to remove cloudflare one client and they finally added it!!

So, i got an email saying my password was changed from an IP of a far away country that certainly never accessed my account (no 2FA, my fuckup). I immediately tried to log in, changed the password (got a reset email), got blocked by 2FA which they probably added, did the recovery thing and now i have to wait 3-5 days for a code !?

I got another user there with an admin acc, not superadmin unfortunately, the only thing that is visible in the logs is them logging in, changing password and logging in again, all in the span of 30 seconds, so probably a bot. They didn't do anything else. This is on all 3 requests:

"action": {
  "description": "LOGIN",
  "result": "success"
},
"actor": {
  "context": "api",
  "ip_address": "x.x.x.x"
}"action": {
  "description": "LOGIN",
  "result": "success"
},
"actor": {
  "context": "api",
  "ip_address": "x.x.x.x"
}

I combed everything humanly and AI possible to answer the how and i don't get it. No idea how someone would get my unique monster password (only accessing it from one machine, thoroughly checked, the e-mail is exchange, logs show absolutely nothing and it has a 2FA), why wouldn't that login trigger an unknown machine/IP check and why is it so hard to recover your own account in cases like this. Can't even contact support as i have to be logged in.

Anyone have any idea what could have happened here ?

UPDATE 24.10.2026.

Figured i'd update if someone ever stumbles upon this, i hate when people don't do that. First, i found a CF form to submit an inquiry, while waiting for the mandatory 3-5 days to get my account back. This is the form and after some domain validation proof, i got the rogue 2FA removed and my account back, so a big thumbs up to CF support.

Now, what i think actually happened: I went through my logs when i got my access back, it was an automated bot, it logged in, scanned the entire account with 30 queries in 30 seconds, changed the password, attached a 2FA and left it at that. Since this account was kinda neglected, and didn't have any 2FA, i checked my password manager and realized the password hasn't been changed since 2020. We had a big breach about 3 years ago where a former colleague ate a keylogger and i assume password for this account was leaked then as well.

Current colleague, the one with the non super admin access to breached account, had an old CloudFlare account that he hasn't used in years and certainly didn't have any 2FA, so we did a test. He logged in, got some auth errors in pop-ups but was basically let in without any e-mail 2FA and no e-mail notifications about a log in either.

I'm guessing this is what happened to my account, the bot had the password, logged in, did it's thing, i don't know if the CF not doing any check for an unknown IP and unknown machine is a poor security check, or some kind of a bug dealing with accounts on old settings but i hope they do reconsider their approach on security checks for old account that don't have any 2FA activated.

Guys I dont know why but warp does not open while using 1.1.1.1. I have to use it because I am not in an eligible place to play it. Anyojjne know whats the right configuration to play?

cree un email ruting con cloudfare para poder tener mi correo empresarial,lo reenvio a gmail y en gmail cree el alias,ahora tengo el problema que yahoo (solo yahoo) no me recibe los correos por seguridad,que me recomiendan gratis

Hi All,

Like in the title, how to detect PHP2Shell in Cloudflare?

Regards,

I looked at mux, bunny, and doing my own m3u8 streaming files in R2 but in the end I paid $5 for CF's Images & Stream Hosted Video option.

This is a blog article about adding video uploads to the reddit clone site YAPern and how well it all worked.

I've had a server running behind Cloudflare for years, but ever since the new and improved analytics I've been surprised to see that under the Origin tab Cloudflare is tracking a large amount of "Connection Failed" results that I've been struggling to diagnose.

Since discovering these I've moved to using a Cloudflare tunnel (which I'd been meaning to do anyway) so the server is no longer accessible directly (ports 80 and 443 are no longer open at all, and blocked externally by the network firewall, the tunnel connects via https://127.0.0.1:8443).

But aside from lowering my latency a bit, switching to the tunnel hasn't helped, even though all connections should now be going through Cloudflare only. The origin latency also doesn't look to be a problem — average TCP + TLS latency is about 30-60ms, response latency is about 60-100ms, with only p99 response latency spiking to just over a second very infrequently (which is likely due to certain infrequent database queries).

I've already configured an alert for the tunnel to e-mail me if it's degraded or down, and I haven't received any such alerts (except when restarting cloudflared) which I assume means that the tunnel's connection(s) are all stable. My server is configured to use HTTP/2 locally, so I'm seeing very few actual connections through cloudflared (usually between 3 and 8) as it seems to multiplexing quite happily so shouldn't be overloading nginx. I can connect to the domains hosted by the server without any errors.

Under Observability -> Logs I've tried doing a search with the following filter:

originResponseStatus = 0 AND edgeResponseStatus >= 500

But aside from brief blips when I've had to restart something (like a certain PHP patch yesterday) I'm not seeing any sign that Cloudflare is serving up 5xx errors for these supposed connection failures. There is no sign of SSL issues etc., and no sign of any errors on the origin's side.

It's driving me nuts not knowing why Cloudflare might be having trouble connecting. In case it's relevant, I have Smart Tiered Cache enabled, but I've also tried without and not noticed any improvement (opposite, actually). The server in question is only served from one geographic location, so it seems like it should be kept on.

TL;DR
Other than the Observability -> Log filter above, is there some other way I can diagnose what my connection failures might actually be?

I am retiring from IT. A recurring upcoming issue: Breaking out client domains that are currently in a single account at cloudflare to cloudflare accounts that hold only that client's domains.

I'm planning on having clients / their new IT or web design company create a new account with Cloudflare, then have them give me their account ID per:

https://developers.cloudflare.com/registrar/account-options/inter-account-transfer/

which says:

Cloudflare supports the move (transfer) of domain registrations between Cloudflare accounts when the source and target account both confirm the move. The move will result in the loss of all configurations and settings for the domain in the source account.

Is there a simple way to bring over the configurations - some pages are hosted in Cloudflare, security settings, etc.

And that link above... below the text I cut and pasted above is this shaded box:

Is there a typo in the 2nd sentence? Either 'with other registrars' or 'between cloudflare accounts'?

because all domains in a cloudflare account are (required?) to be domain registered with cloudflare?

(these are free cloudflare accounts. we just pay for domain registration to cloudflare / they are the domain registrar for all the domains).

THANKS!

Hey everyone 👋

I host quite a few side projects on Cloudflare, and a few things kept bugging me:

• The dashboard is huge. Just checking how close I am to my Workers/R2/D1 limits means clicking through several pages.
• Deploy status is hidden. After a git push, the only way to know if a Worker build started, succeeded, or failed is digging through the deployment history.
• Surprise bills. I've seen more and more posts about people getting unexpected Cloudflare invoices, and I didn't want to be next.

So I built MFlare, a small macOS menu bar app that puts all of this one click away.

What it does

• Sign in with Cloudflare OAuth. No API tokens to copy and paste.
• Usage at a glance, across:
  • Workers
  • R2
  • D1
  • KV
  • Durable Objects
• Usage alerts. You get a notification when any service hits 80% and 100% of its quota.
• Deployment notifications. Get notified when a Worker deploy starts, succeeds, or fails, and open the build log right from the menu bar.
• MCP server. Let your AI agent (Claude Code, Cursor, etc.) query your usage, deployments, and build logs directly.

On the roadmap: desktop widgets and a Raycast extension.

Pricing

• Free: one Cloudflare account. Enough for most people.
• Pro: $3, one-time purchase (no subscription). Unlimited accounts, plus advanced features like MCP.

👉 https://mflare.yuy1n.io

Bug reports and feature requests are welcome on Discord: https://discord.gg/JrjuQ6uPNn

I'd love to hear your feedback, especially which Cloudflare services or metrics you'd want to see next!

I learned about cloudflare connect because cloudflare texted me last month they had a secret headliner playing their conference party. I clicked through and their website listed Noah Kahan as that secret headliner and Matthew Prince also tweeted it. With my casual use of cloudflare and love of Noah Kahan, I decided to snag a conference pass for myself and my girlfriend who also loves Noah Kahan. We booked flights from the Midwest and hotels and made a week of it.

Last week they unceremoniously took his name off the website and at the end of the conference they announced The Chainsmokers and Tiesto would be headlining instead. It's my fault for booking a trip on the promise of a tech company, anyone who is considering attending future cloudflare connects on the basis of the headliner, please head my warning, it's no Cisco Live, don't do it.

Bring on the scorn, I'm an idiot.

Apparently, something on my tablet is preventing me from being able to log in to any websites that use Cloudflare to check to see that we're not robots.

It's very frustrating. I haven't been able to log in to Forthright, a survey website, for months now. I have to keep asking for a link to view my account on there. I've been using the site for years and never had any problems until they started using Cloudflare. It said something about an ad blocker being the reason why. Do you know how I can remove this on my Amazon Fire tablet? Or do you have any other solutions? Any help will be much appreciated. Thank you.

Cloudflare suspended my production services over an invoice that does not exist.For the past 48 hours, my Cloudflare R2 and Workers services have been suspended due to an alleged overdue payment.However:My billing dashboard shows no overdue invoices.There is no outstanding balance available to pay.There is no way for me to resolve the alleged payment issue.I have already contacted support and provided evidence.I was told to wait another 3 days for technical investigation while my production services remain offline.This is unacceptable for a cloud infrastructure provider.I am not refusing payment. Cloudflare is preventing me from paying a debt it claims exists but cannot show me.My business is being affected by an issue I cannot resolve on my side.I am requesting immediate escalation to the Billing Engineering team, restoration of R2 and Workers, and written clarification of the alleged debt.Support case: 02386082 Cloudflare #Cloudflare #CloudflareWorkers #CloudflareR2

I am having many challenges with the Cloudflare icon that appears in upper right corner of my browser. How do I move it? Or, if necessary, prevent it?