# Connect Cloudflare

> Create the Cloudflare API token bohr needs, with the right permissions, and connect your account.

Source: https://docs.bohr.io/getting-started/connect-cloudflare/

bohr creates each project's Worker, the agent's sandbox and the preview in **your** Cloudflare account, with an API token you give it. The instance keeps the token encrypted and only uses it to create and update your projects' Workers.

## Before you start

- The account must be on the **Workers Paid** plan: the agent's sandbox is a Cloudflare Container.
- The account needs a **workers.dev subdomain**. If you never opened **Workers & Pages** in the Cloudflare dashboard, open it once: that creates the subdomain.

## Create the token

1. In the **Cloudflare** step, click **Create the token on Cloudflare**. It opens Cloudflare's token page with the main permissions filled in.
2. **Before saving, add the `Containers: Edit` permission.** The link cannot fill it in.
3. Create the token, copy it, paste it in **Cloudflare API token** and click **Connect**.

The token needs these permissions:

| Permission | Why |
| --- | --- |
| **Workers Scripts: Edit** | Creates the project Workers. It also covers Durable Objects and the workers.dev subdomain. |
| **Account Settings: Read** | Reads the account's details. |
| **Containers: Edit** | The agent's sandbox. Needs the Workers Paid plan. **Add it by hand.** |
| **D1: Edit** | Creates the database of projects started from a [template](https://docs.bohr.io/getting-started/templates/). Filled in by the link; only template projects need it. |

When something is missing, the panel shows *"The token lacks some permissions"* with the list. Edit the token on Cloudflare (or create another one from the template), add what is missing and paste it again.

### Several accounts

If the token can see more than one Cloudflare account, bohr asks **Choose the Cloudflare account**: pick the one your projects should run in and click **Use this account**.

## What bohr leaves in your account

So you can tell bohr's work apart from yours:

- Every Cloudflare API call bohr makes sends `User-Agent: bohr/<version> (+https://bohr.io)`; it shows in your account's audit log.
- The Workers bohr creates (each project's agent Worker and preview Worker) carry the tags `bohr` and `bohr-project:<id>`, and their deployments the message `bohr`.
- Production deploys run `wrangler deploy --message "bohr" --tag "bohr-<commit>"`.

## Later

- Connected accounts are listed in **Account › Connected accounts › Cloudflare**. You can [disconnect](https://docs.bohr.io/account/connections/) an account once no project uses it; also delete the token in the Cloudflare dashboard (**My Profile → API Tokens**).
- An [organization](https://docs.bohr.io/organizations/settings-and-billing/) connects its own Cloudflare account, separate from yours.