EmailFlare needs a Cloudflare API token with specific Email Sending, DNS, and routing permissions.
This guide walks through every step — from the API Tokens page to your .env.local file.
Go to dash.cloudflare.com/profile/api-tokens. Click Create Token and choose Create Custom Token at the bottom of the template list.
Give it a descriptive name so you can identify it later — for example emailflare-deploy or emailflare-prod.
Under Permissions, add each row in the table below. For each permission, you select the resource type and the access level from dropdowns.
| Permission | Scope | Access |
|---|---|---|
Email Sending | Account | Edit |
Email Security | Account | Edit |
Access: Users | Account | Read |
Account Settings | Account | Read |
Email Routing Rules | Zone | Edit |
Zone | Zone | Read |
DNS | Zone | Edit |
Under Account Resources, set to your Cloudflare account. Under Zone Resources, you can either include all zones or restrict to a specific zone for the sending domain.
Click Continue to summary, review the permissions, then click Create Token. Cloudflare will show you the token value once — copy it immediately.
Go to dash.cloudflare.com, click any domain, and look at the right sidebar under API. Your Account ID is a 32-character hex string.
dash.cloudflare.com/<account-id>/… For Docker self-hosting, add the values to your .env.local. For Cloudflare Workers, add them to scripts/config.toml.
.env.local (Docker)
scripts/config.toml (Workers)
just worker-setup for Workers or docker compose up for Docker — EmailFlare will use these credentials for all Cloudflare API operations.