EmailFlare needs a Cloudflare API token with specific Email Sending, DNS, and routing permissions. This guide walks through every step — from the API Tokens page to your .env.local file.
Go to dash.cloudflare.com/profile/api-tokens. Click Create Token and choose Create Custom Token at the bottom of the template list.
Give it a descriptive name so you can identify it later — for example emailflare-deploy or emailflare-prod.
Under Permissions, add each row in the table below. For each permission, you select the resource type and the access level from dropdowns.
| Permission | Scope | Access |
|---|---|---|
Email Sending | Account | Edit |
Email Security | Account | Edit |
Workers Scripts | Account | Edit |
Access: Users | Account | Read |
Account Settings | Account | Read |
Email Routing Rules | Zone | Edit |
Zone | Zone | Read |
Zone Settings | Zone | Edit |
DNS | Zone | Edit |
POST /zones/{id}/email/routing/enable) is gated by Zone Settings: Edit — not by "Email Routing Rules". There is no obvious "Email Routing" entry in the permission list, so without Zone Settings: Edit the enable step fails with an authentication error even though everything else works.Under Account Resources, set to your Cloudflare account. Under Zone Resources, you can either include all zones or restrict to a specific zone for the sending domain.
Click Continue to summary, review the permissions, then click Create Token. Cloudflare will show you the token value once — copy it immediately.
Go to dash.cloudflare.com, click any domain, and look at the right sidebar under API. Your Account ID is a 32-character hex string.
dash.cloudflare.com/<account-id>/…For Cloudflare Workers (primary), add the values to scripts/config.toml. For Docker self-hosting (secondary), add them to your .env.local.
.env.local (Docker)
scripts/config.toml (Workers)
just worker-setup for Workers or docker compose up for Docker — EmailFlare will use these credentials for all Cloudflare API operations.