Separate accounts, zones, and credentials

Cloudflare resources live at two scopes, and knowing which is which saves you from confusing permission errors.

A zone is one domain and everything attached to it: DNS records, TLS settings, WAF rules, cache configuration. An account contains zones plus the developer platform resources. A Worker, a D1 database, and an R2 bucket belong to an account, not to any single zone.

See where you are working:

npx wrangler whoami
# Getting User settings...
# You are logged in with an OAuth Token, associated with the email [email protected].
# Account Name         Account ID
# Flavio's Account     0f3b2a1c9d8e7f6a5b4c3d2e1f0a9b8c

Wrangler commands act on this account. If a team member “cannot see the database,” check which account they are in before debugging anything else.

Credentials that match the job

Cloudflare still offers a legacy Global API Key that can do everything the account can do. Do not build automation on it. Use API tokens instead: each token gets specific permissions on specific resources, so a CI token that deploys one Worker cannot delete DNS records.

For CI, pass the token through the environment:

CLOUDFLARE_API_TOKEN=your-scoped-token npx wrangler deploy

Interactive use goes through npx wrangler login with your own user. Use individual users with suitable roles rather than one shared login — when someone leaves, you remove their user instead of rotating every credential the team shares.

Keep secrets out of source and logs. A token in a repository outlives the repository’s privacy settings.

Separate production from practice

Separate production resources from practice resources so a local command cannot mutate real traffic by accident. Different names are the minimum (my-app-db vs my-app-db-dev); a different account for production is stronger, because then no credential in daily use can touch it.

Now create a resource inventory for your practice setup:

resource        scope     account        environment  owner    recovery contact
example.com     zone      Flavio's Acct  production   flavio   [email protected]
my-app-db       account   Flavio's Acct  production   flavio   [email protected]

Record account, zone, environment, owner, and recovery contact. Do not record credentials — the inventory tells you what exists and who to call, not how to get in.