Create a read-only Cloudflare API token

Cloudflare has two kinds of credentials. The Global API Key can do anything your user can, on every account: never give it to a third party. An API token can be scoped to exact permissions and one account. Glow asks for an account-owned API token with Read permissions only.

Step by step

1. In Glow, tap Connect Cloudflare. It opens Cloudflare’s Create Token page with these permissions already selected: Account Billing Read, Account Analytics Read, Workers Scripts Read, Zone Analytics Read.
2. Choose the account Glow should read, and (optionally) limit zones.
3. Click Continue to summary, then Create Token.
4. Copy the token; Cloudflare shows it once.
5. Paste it into Glow. Glow seals it immediately and never shows it again.

Prefer to do it by hand? My Profile → API Tokens → Create Token → Create Custom Token, and add only the four Read permissions above.

How Glow checks it

Glow verifies the token is active, then reads the token’s own policy and checks that every permission group is a Read group. A token with any Edit permission is refused.

What you get

Billable usage this month as dollars (Workers, R2, D1, KV, Workers AI), zones and Workers mapped to products, and idle paid add-ons flagged as savings.