CFL002 - Cloudflare Authorization Failed

Uploading...Agent error code #CFL002 indicates that Cloudflare returned HTTP 403. The API token is valid and does not carry the permission the operation needs.

This is distinct from #CFL001, where the token itself was rejected.

Common causes include:

The token lacks the Account Filter Lists permission The token has read access to lists but not edit access The token is scoped to a different account from the one holding the list The token is scoped to specific zones, which does not grant account-level list access

Steps to Resolve

Grant the Filter Lists Permission

In the Cloudflare dashboard, go to My Profile > API Tokens Edit the token used by Knocknoc Add the permission Account > Account Filter Lists > Edit Save, then retry the grant from Knocknoc

Read access alone is not enough. The agent has to modify the list to apply a grant.

Confirm the Account Scope

Rule lists belong to an account, not a zone.

In the token's Account Resources, confirm the account holding the list is included A token scoped only to zones cannot reach account-level lists no matter which zones are selected

Confirm Which Account Holds the List

In the Cloudflare dashboard, go to Manage Account > Configurations > Lists Confirm the list is in the same account the token is scoped to

For the full setup, see the Cloudflare IP lists page.