Flarectl

flarectl — Cloudflare CLI Skill

Important: Scope Boundaries

flarectl manages zones, DNS, firewall rules, cache, and zone exports. It does NOT support Workers, Pages, R2, KV, D1, or Queues — use Wrangler (npm i -g wrangler) for those.

flarectl is legacy software (v0 branch of cloudflare-go). It works and is installable via Homebrew (v0.116.0+), but receives no new features.

Onboarding Workflow

Guide users through setup in this order:

1. Install → verify with flarectl --version
2. Authenticate → choose API Token (recommended) or Global API Key
3. Verify access → run flarectl zone list or flarectl user info
4. Verify token permissions → run scripts/cf-check-access.sh

See references/setup-guide.md for detailed installation and authentication instructions.

Authentication Quick Reference

Precedence: CF_API_TOKEN wins if set. Otherwise both CF_API_KEY and CF_API_EMAIL required.

Note: flarectl uses CF_ prefixed vars. Wrangler uses CLOUDFLARE_ prefixed vars. They are NOT interchangeable.

Verifying Access & Permissions

Run scripts/cf-check-access.sh to verify token validity and test common permissions. Or manually:

# Verify token is valid (API Token only)
curl -s "https://api.cloudflare.com/client/v4/user/tokens/verify" \
  -H "Authorization: Bearer $CF_API_TOKEN" | jq .

# List token details and policies
curl -s "https://api.cloudflare.com/client/v4/user/tokens" \
  -H "Authorization: Bearer $CF_API_TOKEN" | jq '.result[] | {name, status, policies}'

# Quick permission tests via flarectl
flarectl zone list          # Tests Zone:Read
flarectl user info          # Tests User Details:Read
flarectl dns list --zone example.com  # Tests DNS:Read

Required Token Permissions by Command

Command Reference

See references/command-reference.md for the complete command reference with all flags and examples covering:

• Zone management (list, info, create, delete, purge, export, lockdown)
• DNS record CRUD (list, create, update, create-or-update, delete)
• Firewall access rules (list, create, update, delete — IP/CIDR/ASN/country)
• User-agent blocking, page rules, IP ranges
• Command aliases quick reference

Global Options

--json            Output as JSON instead of ASCII table
--account-id <id> Account ID (or set CF_ACCOUNT_ID)
--help, -h        Show help
--version, -v     Show version

Always use --json when parsing output programmatically.

Common Workflows

Add a zone and configure DNS

flarectl zone create --zone example.com --jumpstart
flarectl dns create --zone example.com --name www --type A --content 203.0.113.50 --proxy
flarectl dns create --zone example.com --name @ --type MX --content mail.example.com --priority 10

Bulk DNS update (idempotent)

# create-or-update is an upsert — safe to run repeatedly
flarectl dns create-or-update --zone example.com --name app --type CNAME --content new-backend.example.com --proxy

Purge cache

flarectl zone purge --zone example.com --everything
# Or selective:
flarectl zone purge --zone example.com --files "https://example.com/style.css"

Export zone file (BIND format)

flarectl zone export --zone example.com > example.com.zone

Block an IP via firewall

flarectl firewall rules create --zone example.com --value 198.51.100.1 --mode block --notes "Abuse"

When to Use Wrangler Instead