cfctl

Get started

Install. Connect. Read.

Start by listing Workers in one Cloudflare account. This walkthrough reads your account without changing it.

  1. Build and install from source

    Clone the repository, review the source, and run bootstrap from the clean checkout. It verifies the project, installs cfctl, and checks that the installed binary matches the source. This is a local source build; source-only releases do not contain prebuilt installers.

    Terminal · source installation
    git clone https://github.com/rogu3bear/cfctl.git cd cfctl ./bootstrap.sh export PATH="${CARGO_INSTALL_ROOT:-$HOME/.local}/bin:$PATH" cfctl version --jsonReady to copy.

    Keep the install directory on PATH in your shell configuration for future terminals. Bootstrap refreshes already-managed agent integrations. Use its --skip-agent-sync option if you want a binary-only installation. See the installation guide for requirements and release verification.

  2. Choose credential storage

    Preview private local storage, then review and run the activation command it returns. This avoids platform password dialogs. Other software running as your OS user can access these private files. An existing installation should review which profiles and approvals the transition affects.

    Preview the storage choice
    cfctl auth evidence-key private-preview --jsonReady to copy.

    After activation, check the storage status and local setup.

    Check your installation
    cfctl auth evidence-key status --json cfctl doctor --json cfctl agents doctor --jsonReady to copy.

  3. Connect one account

    Replace your-account-id below. Load your existing scoped token into CLOUDFLARE_API_TOKEN through your secure local workflow; never paste it into chat, source code, or command arguments. The pipe sends the value to cfctl through standard input.

    Import an existing read token
    ACCOUNT_ID='your-account-id' printf '%s' "$CLOUDFLARE_API_TOKEN" | cfctl auth import-api-token --profile first-read --account "$ACCOUNT_ID" --stdin --json unset CLOUDFLARE_API_TOKENReady to copy.

    Need a token? The authentication guide explains creating a scoped token from a qualified parent and reviewing its separate approval.

  4. Inspect the operation, then read

    The guide explains required permissions and inputs. The second command reads Workers using the same profile and account you just configured.

    Inspect the operation
    cfctl guide listWorkers --jsonReady to copy.
    List Workers · read only
    cfctl call listWorkers --profile first-read --account "$ACCOUNT_ID" --selector account_id="$ACCOUNT_ID" --jsonReady to copy.

    A successful response has ok: true and performed: true, with result data and evidence references. An empty list can mean the account has no Workers. This is a live read; it does not verify a deployment or change your account.

Where to go next

Use cfctl resolve to map an intent to an operation, or cfctl catalog search to explore. If a request is ambiguous, inspect the returned candidates and choose the exact capability before calling it.

For writes, inspect the returned plan and its operation ID. Required approval and execution are separate steps. Follow the first-write walkthrough when you are ready.