Cloudflare

Create a read tokenCopy Anchor Link

Create a dedicated Cloudflare API token limited to the account and zones under review. Grant:

• Account Settings: Read.
• Zone, Zone Settings, DNS and Zone WAF: Read.
• Access Apps and Policies: Read.
• Access Organizations, Identity Providers and Groups: Read.
• Workers R2 Storage and Workers Scripts: Read.

Enter the account ID and API token in Sparta. This token collects evidence; it is separate from authorization used to install Sparta.

Define the production boundaryCopy Anchor Link

Select the relevant zones and Workers. Where applicable, identify the platform hostname, Access application and identity provider.

Document approved public buckets and allowed plaintext Worker variables. An allowlist should describe an intentional exception, not hide an unresolved exposure.

Optional log evidenceCopy Anchor Link

Logpush inspection uses a separate credential with Cloudflare's Logs: Edit permission. That vendor permission is broader than Sparta's read operations; grant it only if this evidence is needed. Account-level Zero Trust log access may also require Zero Trust PII: Read.

Run the connection check, collect evidence and inspect missing-permission or unsupported results before relying on them.

Connect evidence sources · Deployment requirements