Start

The read-only token

The one Cloudflare permission SignalFlare needs to watch spend, and how it is stored.

Monitoring needs a single permission:

Account · Account Analytics · Read

Optionally add Zone · Analytics · Read if you want zone-level breakdowns. Nothing else.

What this token can and can’t do

It can read usage analytics through Cloudflare’s GraphQL Analytics API. It cannot change DNS, deploy or edit Workers, read your code, read secrets, or change any setting. If it leaked, the worst case is someone reading your usage numbers.

How we store it

• Encrypted at rest with AES-256-GCM. The key lives in a Worker secret, not the database.
• Decrypted only in memory, only to poll.
• Never written to logs and never returned by the API. The dashboard shows the last four characters so you can tell tokens apart.

Revoking

Delete the token in Cloudflare at any time and we lose access immediately. The next poll marks the account as needing a new token and notifies you. Removing the account in SignalFlare deletes the encrypted token; its spend history stays until you delete your organization.

The write token is different

Hard caps use a separate token with write scopes. It’s never used for monitoring, and the read-only token is never widened. See hard caps.