Skip to main content

CFL002 - Cloudflare Authorization Failed

Agent error code #CFL002 indicates that Cloudflare returned HTTP 403. The API token is valid and does not carry the permission the operation needs.

This is distinct from #CFL001, where the token itself was rejected.

Common causes include:

  • The token lacks the Account Filter Lists permission
  • The token has read access to lists but not edit access
  • The token is scoped to a different account from the one holding the list
  • The token is scoped to specific zones, which does not grant account-level list access

Steps to Resolve

Grant the Filter Lists Permission

  1. In the Cloudflare dashboard, go to My Profile > API Tokens
  2. Edit the token used by Knocknoc
  3. Add the permission Account > Account Filter Lists > Edit
  4. Save, then retry the grant from Knocknoc

Read access alone is not enough. The agent has to modify the list to apply a grant.

Confirm the Account Scope

Rule lists belong to an account, not a zone.

  1. In the token's Account Resources, confirm the account holding the list is included
  2. A token scoped only to zones cannot reach account-level lists no matter which zones are selected

Confirm Which Account Holds the List

  1. In the Cloudflare dashboard, go to Manage Account > Configurations > Lists
  2. Confirm the list is in the same account the token is scoped to

For the full setup, see the Cloudflare IP lists page.

Back to top