Create a Cloudflare API token
Generate a minimal-permission token so bao can deploy to your Cloudflare account without access to DNS, billing, or account settings.
bao deploys to your Cloudflare account using a Personal API Token. This guide walks you through creating a token with the minimum permissions required — so bao can do its job without having the keys to your entire account.
Why scoped tokens?
A scoped token limits the blast radius if a secret is ever leaked. bao only needs access to Workers, D1, KV, and Pages — not your DNS, billing, or account settings.
Open the Cloudflare API Tokens page
Go to dash.cloudflare.com → Profile → API tokens and click Create Token.
Use the “Create custom token” option
Scroll past the templates and click Get started under Create Custom Token. The templates give too many permissions — we’ll set exactly what bao needs.
Set the required permissions
Add the following permission rows:
| Resource | Permission | Why |
|---|---|---|
Account · Workers KV Storage | Edit | Create and write to the KV namespace for secrets |
Account · D1 | Edit | Create and migrate the auth database |
Account · Workers Scripts | Edit | Upload Worker scripts |
Scope to your account
Under Account Resources, select Include → Specific account and choose your account.
Copy the token
Click Create Token, then copy the token value immediately — Cloudflare will not show it again.
Don't worry
You can always Roll the token and update it in GitHub.
Next: add it to GitHub Secrets
Once you have your token, follow the GitHub Secrets guide to wire it into your bao deployment.