Your agency has asked for access to Cloudflare. You don't need to share your password for it. Cloudflare lets you add them with their own login, choose exactly what they can do, and remove them when the project ends. These are the clicks, checked against Cloudflare's own help pages in October 2026.
Which role to choose
Pick the narrowest role that lets your agency do the work. Domain Administrator is usually the right one.
| Role | What it allows | For an agency |
|---|---|---|
| Domain Administrator | Full control of the chosen domain, with read only access to account-wide Firewall, Access and Workers. | Usually the right one |
| Administrator | The whole account, except members and the billing profile. | If the work needs it |
| Domain DNS | Edits DNS settings for the chosen domain only. | If the work needs it |
Add your agency to Cloudflare
- In the Cloudflare dashboard, go to the Members page and select Invite members.
- Under Add email addresses, enter your agency's email address.
- Under Add permission policies, choose your domain as the scope, select Domain Administrator and select Create policy.
- Select Invite members.
Only a Super Administrator with a verified email address can invite members. For Administrator, choose the entire account as the scope.
How you both know it worked
Cloudflare emails your agency an invitation from cloudflare.com. Once they accept it, they show in your Cloudflare account's list of people with access, where you can see or change their role at any time.
Remove access when the project ends
- In the Cloudflare dashboard, go to the Members page.
- On the row for your agency's email address, select the menu (...), then Remove member, and confirm.
- Delete any account API tokens your agency created.
Do you have to share your password?
No. Every step above uses Cloudflare's own invite, so your agency signs in with their own account, your two-step verification stays on, and anything they change is recorded under their name. How to give a developer access without sharing your password covers the other accounts agencies usually ask for.
Doing this for every client?
Agencies can send each client one Get Set Keys link instead of a page like this. It walks the client through Cloudflare and the other platforms the project needs, and checks that each step is done.