Give This Machine Its Cloudflare Token

Give This Machine Its Cloudflare Token

BoB works in Cloudflare with one working token per machine, named bob-<machine id>. BoB mints it itself, with the root token you made once in the Cloudflare dashboard. You never type or copy the working token. The full rules are in the Cloudflare Tokens reference.

Before you start

• The root token is in this machine’s keychain as CLOUDFLARE_ROOT_TOKEN.
• The operator repo’s config/cloudflare-accounts.json names both tokens for the account, and operator.json declares both names under secrets[].

Check the root token is there:

bob secrets check

You should see: CLOUDFLARE_ROOT_TOKEN present.

Broken looks like: CLOUDFLARE_ROOT_TOKEN MISSING. Stop and paste me what you got.

1. Mint the working token (once)

See what would be created. Nothing is changed.

bob cloudflare mint --machine macbook-pro-16

You should see: DRY RUN: would create bob-macbook-pro-16 in account bb4c9b919e317b42c003591ab2cc4ecd.

Broken looks like: the root token CLOUDFLARE_ROOT_TOKEN ... is missing, or this machine is ..., not macbook-pro-16. Stop and paste me what you got.

Then create it:

bob cloudflare mint --machine macbook-pro-16 --apply

You should see: minted bob-macbook-pro-16 ... stored at keychain:CLOUDFLARE_WORKING_TOKEN. No token value is ever printed.

Broken looks like: Cloudflare refused to let the root token ... grant. BoB has filed a todo with the steps to build the token in the dashboard; follow it. Any other message: stop and paste me what you got.

2. Check it

bob cloudflare verify

You should see three lines: the account id bb4c9b919e317b42c003591ab2cc4ecd, the token bob-macbook-pro-16 and status active.

Broken looks like: no Cloudflare working token on this machine (step 1 did not store it) or Cloudflare rejected the working token. Stop and paste me what you got.

3. Prove it can write, and only here

bob cloudflare verify --write

You should see two more lines: write created and deleted KV namespace bob-verify-… and refused a read of account <the other declared account> with the same token was refused.

Broken looks like: could not create the KV namespace, or the working token can read account …. Stop and paste me what you got.

If the machine lost its token

A token’s value cannot be read back from Cloudflare. Delete it and mint a new one:

bob cloudflare mint --machine macbook-pro-16 --apply --replace