cf-vault | Manage your Cloudflare credentials | Key Value Database library

First step is to generate a new API key or API token. Either will work however there are some subtle differences to take into consideration before choosing your path. While it is possible (and better practice of principle of least privilege), to use an API token with only permissions to create a new API token, this isn't really viable for all use cases yet. The recommended approach is to use the API key for the profile and rely on a custom policy to scope the short lived credential. This allows the best of both worlds where if you need to use a service that doesn't support API tokens, you don't need to create a new profile.
First step is to generate a new API key or API token. Either will work however there are some subtle differences to take into consideration before choosing your path. API tokens are not supported by all services yet. Regardless of whether you are using the short lived credentials or long lived token, it may not work for all services and you may need to have a backup profile defined using an API key to cover all scenarios . API keys are supported everywhere however they cannot be scoped. API keys have the permission and scopes that your user account has. This can be dangerous so be sure to tread carefully as it may have unintended consequences. While it is possible (and better practice of principle of least privilege), to use an API token with only permissions to create a new API token, this isn't really viable for all use cases yet. The recommended approach is to use the API key for the profile and rely on a custom policy to scope the short lived credential. This allows the best of both worlds where if you need to use a service that doesn't support API tokens, you don't need to create a new profile. To create a new API token: > https://dash.cloudflare.com/ > My Profile > API Tokens > Create API token To retrieve your API key: > https://dash.cloudflare.com/ > My Profile > API Tokens > Global API Key
If you're using an API key, you can skip to the next step. Otherwise, navigate through the UI and configure what permissions and resources you'd like to assign to the token. If you're looking to use an API token to generate short lived API tokens, you should only need the single predefined "Create API tokens" permission. See the section below on generating the desired TOML output for instructions on how to do automatically convert policies from API responses. Note: Be sure to note down the API token before closing/navigating away from the UI as you won't be able to retrieve it again.
Once you have your API key or API token value, you can start using cf-vault by creating a profile. A profile is the collection of configuration that tells cf-vault how you intend to interact with the Cloudflare credentials. You need to start by calling cf-vault add [your-profile-name] where [your-profile-name] is a label for what the credential/use of the profile is. Some examples: cf-vault add write-everything cf-vault add read-only cf-vault add super-scary-access-everything cf-vault add api-token-to-create-other-tokens There is no limit on how many profiles you have if you prefer to have specific profiles for your use cases.
Now that you have created a profile, you can use it with cf-vault exec [your-profile-name].