CFL000 - Failed to Connect to Cloudflare

Agent error code #CFL000 indicates that the agent could not complete a request to the Cloudflare API. The failure happened at the network layer, so no HTTP status came back to classify.

This is distinct from authentication failures (#CFL001) and authorization failures (#CFL002), where Cloudflare did answer and refused the request.

Common causes include:

The agent host has no outbound HTTPS route to api.cloudflare.com
DNS resolution for api.cloudflare.com fails on the agent host
An HTTP proxy is required but the agent's service environment does not carry the proxy variables
The request timed out before Cloudflare answered

Steps to Resolve

Confirm Connectivity From the Agent Host

curl -sS -o /dev/null -w '%{http_code}\n' https://api.cloudflare.com/client/v4/user/tokens/verify

A 400 or 401 is fine here. It proves the endpoint is reachable. A connection error or a hang is the problem the agent is hitting.

Check DNS

getent hosts api.cloudflare.com

If this returns nothing, the agent host cannot resolve the API endpoint.

Check Proxy Configuration

The agent inherits the service manager's environment, not your login shell's.

If the host reaches the internet through a proxy, confirm HTTPS_PROXY is set in the agent's unit file or environment file
Restart the agent after changing it

Check Egress Filtering

Allow outbound TCP 443 to api.cloudflare.com from the agent host. Cloudflare does not publish a stable list of egress addresses for the API, so allow by hostname where your firewall supports it.