How to create a Cloudflare API token for seops

Give seops read access to security events, AI crawlers, usage and D1 backups.

An API token is a key with only the permissions you pick. seops asks for read access to analytics, plus D1 edit only if you want nightly database backups. The token is stored encrypted and used only for the sites you choose.

What opens in seops

2 · Health › Security › Cloudflare events and 3 · Growth › AI visibility › AI crawlers, per zone
Workers, D1 and R2 usage against plan limits
Nightly D1 backups to R2 (needs the D1 Edit permission)

Steps

Open the token page

Create Token → at the bottom Custom token → Get started.

API tokens ↗

Pick permissions

Name: seops. Add these rows: Account → Account Analytics → Read, Zone → Analytics → Read, Zone → Zone → Read. Optional: Account → D1 → Edit for backups and Account → Billing → Read for plan detection.

Pick the scope

Account Resources: your account. Zone Resources: All zones, or only the domains you track. Continue to summary → Create Token. Copy it; it is shown once.

Paste the token in seops

In seops open Account › Setup, paste the token in the Create a Cloudflare read-only token step and press Check (no such step? use Change the stack or features). seops verifies it and stores it encrypted; afterwards only the last 4 characters show under Settings › Project settings › Saved keys. The step appears only when the domain goes through Cloudflare. Stored with AES-GCM; delete it there or revoke it on the token page any time.

How to use it in seops

2 · Health › Security › Cloudflare events; 3 · Growth › AI visibility › AI crawlers; Settings › Infrastructure › Cloudflare usage
Settings › Infrastructure › Backups: nightly D1 dumps

Questions

D1 backup says "Authentication error"

The token lacks Account → D1 → Edit. Edit the token and add it.