CFL001 - Cloudflare Authentication Failed

Agent error code #CFL001 indicates that Cloudflare returned HTTP 401 for the API token configured on the knoc. The token was rejected before any permission check took place.

Common causes include:

• The API token was revoked or has expired
• The token value on the knoc has a typo, or carries leading or trailing whitespace
• A Global API Key was entered where an API token is expected
• The token was created in a different Cloudflare account

Steps to Resolve

Verify the Token

Cloudflare provides an endpoint that checks a token on its own:

curl -sS -H "Authorization: Bearer <token>" \
  https://api.cloudflare.com/client/v4/user/tokens/verify

A successful response reports the token as active. A 401 confirms Cloudflare is rejecting it.

Re-enter the Token

1. In the Knocknoc admin interface, open the backend configuration for the affected knoc
2. Re-enter the API token, taking care not to include surrounding whitespace
3. Save and retry the grant

Confirm It Is an API Token, Not a Global API Key

The agent authenticates with a bearer token. A Global API Key uses a different scheme and is rejected here.

1. In the Cloudflare dashboard, go to My Profile > API Tokens
2. Use a token from the API Tokens section, not the API Keys section

Create a Replacement Token

If the original was revoked, create a new one with the permissions described on the Cloudflare IP lists page and update the knoc.