Cloudflare – can we use API Token and with which permissions? Kindly, thank you!

Hello @fritex

Thank you for reaching out and I am happy to assist you with this.
As mentioned in the topic you shared, the only way at the moment is to use Cloudflare’s Global API Key.
Let me have a chat with the team and I’ll get back to you once I have more details regarding the future implementation.
Thanks!

Hello @fritex

Thank you for your patience.
I’ve opened a Github issue in our repository on your behalf.
Please make sure to track the progress of the issue and feel free to add any useful suggestions.
Thanks!

Greetings @vmarko!

Thank you very much for your reply!

Kindly, if it is somehow possible to realize that in 2022 at least.

Unfortunately, it becomes a necessary and a need as far as for users who are in a situation where it would be good to consider having and using API Tokens for each Website with required permissions (which can be selected and noted which are needed for the W3TC plugin – like zone management, purge cache, SSL, etc. – read or write) rather than using Global API key (all domains under the same, or not Cloudflare Account) as far as it the Global API key could get compromised by that way of usage and took over all the domains from that user, change settings, delete, etc., and all that only if one Website get’s malware or some other “bad person” stealing and sniffing out where it could be stored/saved (or it isn’t saved and stored in some table in the database?), etc.

It’s preventive in terms of security measurements.

Thank you for considering this idea and opening the ticket.

Patiently will watch out for the further release of your great cache plugin for WordPress with this kind of feature!

Take care and stay healthy as much as you can be

Sincerely,
Tomislav
Croatia