How to get added to a client's Cloudflare account

When harborfitnessclub.com runs on Cloudflare and Theo at Northside Studio needs to work on it, Dana at Harbor Fitness can add him to her Cloudflare account as a member. Theo signs in as himself, with his own two-factor authentication, and Dana decides exactly which domain he can reach and how much he can change. Every change he makes is recorded under his own name, ownership and billing stay with Dana, and she can end his access whenever she likes.

Labels below come from Cloudflare's documentation at the time of writing. If you're not sure the domain's DNS runs on Cloudflare, Registrar access without passwords shows how to check.

How Cloudflare access works

Cloudflare gives people access as members of an account. Each member holds one or more permission policies, and each policy pairs one scope with one or more roles:

• The entire account covers every domain in it and takes account-scoped roles, such as Administrator.
• A specific domain, or a group of domains, takes domain-scoped roles, such as Domain DNS.

A member's access is the sum of their policies, so Dana can start narrow and add more later. Policies can also be layered. Cloudflare's own example is an account with production and staging domains, where one person configures staging but can only purge the cache on production. For you, that might mean Domain Administrator on a staging domain and Domain DNS on harborfitnessclub.com. If you look after several of her domains, a Super Administrator can gather them into a domain group under Settings > Lists, using Domain Group Manager, and scope one policy to the whole group.

To invite anyone, Dana needs the Super Administrator role and a verified email address.

One link per client, with every step checked. Reserve a founding place

The roles that fit an agency

Domain DNS is the narrow, safe choice for pointing a domain at a new site or adding verification records. Domain Administrator suits agencies that also look after the domain's security, caching and performance settings. After launch, Domain Administrator Read Only lets you look without changing anything, and Cache Domain Purge lets you clear the domain's cache after an update.

If you build on Workers or Pages for Dana, a domain role won't be enough, because Domain Administrator can only read account-wide Workers. That calls for an account-scoped policy as well, such as Workers Platform Admin, which covers Workers, Pages and Cloudflare's other developer platform products (Cloudflare roles).

What Dana clicks

If you're asking by email, one line covers it: "Please invite theo@northsidestudio.agency to your Cloudflare account, scoped to harborfitnessclub.com, with the Domain DNS role." Dana then follows these steps:

1. In the Cloudflare dashboard, go to the Members page and select Invite members.
2. Under Add email addresses, enter your work email.
3. Under Add permission policies, choose harborfitnessclub.com as the scope rather than the entire account, select Domain DNS or Domain Administrator, then select Create policy.
4. Select Invite members.

You show as Pending until you accept the email invitation. If it gets lost or expires, Dana selects the menu (...) on your row and chooses Resend invite. To change your access later, she uses (...) > View & Edit permission policies on the same row. Full steps: Cloudflare access, step by step.

If several of your people need access, Dana can enter all of their addresses in one invite, separated by commas, and they get the same policy. Each person signs in with their own login, which keeps the audit trail clear.

Two-step verification on both sides

Cloudflare calls it two-factor authentication (2FA) and recommends it for every user. Once you're a member, your login opens Dana's domain, so it matters on both sides:

• Dana can require it. A Super Administrator can turn on 2FA Enforcement, which requires every member to set up 2FA, and invitees then have to turn it on before they can accept. It's worth switching on before she invites anyone.
• You set up your own. In your Cloudflare profile, open Authentication and add an authenticator app, a security key or email codes. Cloudflare recommends at least two methods, with your backup codes stored somewhere safe. Your email address must be verified first.

Sending this to a client? Send one link instead

Removing access at the end

Before you go, give Dana a short list of the DNS records you added and which ones the site still needs. Then she removes you:

1. Go to the Members page.
2. On your row, select (...) > Remove member, then confirm with Remove member.

That also cancels an invite that's still pending. You can leave on your own too: on the Members page, select (...) on your own row, then Leave account.

Removing a member doesn't remove account API tokens. Cloudflare designed account API tokens to keep working after the person who set them up has left, so Dana should delete any you created under Manage account > Account API tokens, where a Super Administrator can see them all. User API tokens act on your behalf with a subset of your permissions, so delete any you made for the project as well. Then Dana can look over recent changes under Manage Account > Audit Logs, which records actions taken in the dashboard and through the API (Cloudflare).

Doing this for every client?

Get Set Keys gives each client one link that walks them through this Cloudflare invite, with your email, their domain and the role already filled in, and turns the step green when Cloudflare's invite email arrives. Porter, the setup helper on every link, answers their questions straight away and passes anything it can't answer to you. Reserve a founding place before Get Set Keys launches in November 2026.