Keep access scoped
Use an account-pinned token with the permissions needed for the job. Choose platform storage or explicit private local storage. Private files are accessible to software running as your OS user.
Security
Review the plan. Control the change.
cfctl keeps credentials, approval, execution, and verification separate. A token gives access to Cloudflare; it does not approve every action that access makes possible.
Inspect before execution
A write produces a plan binding the account, target, input, permissions, cost, verification, and recovery information. Changed inputs invalidate that binding.
Authorize the exact operation
Protected work requires approval of its operation ID. A narrow safe class may be admitted by deterministic policy; bounded token automation requires a separately approved standing policy.
Check before retrying
Inspect operation status after a failure. If execution may have reached Cloudflare, reconcile the saved records with plans rectify instead of running the mutation again.
Inspect the security model.
Security policy and release identities
Runtime policy and approval rules
Credential handling and threat model
Public cfctl OAuth is disabled. Routine setup uses a scoped API token; an explicitly configured OAuth client is a separate option.