Skip to main content

CFL002 - Cloudflare Authorization Failed

Agent error code #CFL002 indicates that Cloudflare returned HTTP 403. The API token is valid and does not carry the permission the operation needs.

This is distinct from #CFL001, where the token itself was rejected.

Common causes include:

  • The token lacks the Account Filter Lists permission
  • The token has read access to lists but not edit access
  • The token is scoped to a different account from the one holding the list
  • The token is scoped to specific zones, which does not grant account-level list access

Steps to Resolve

Grant the Filter Lists Permission

  1. In the Cloudflare dashboard, go to My Profile > API Tokens
  2. Edit the token used by Knocknoc
  3. Add the permission Account > Account Filter Lists > Edit
  4. Save, then retry the grant from Knocknoc

Read access alone is not enough. The agent has to modify the list to apply a grant.

Confirm the Account Scope

Rule lists belong to an account, not a zone.

  1. In the token's Account Resources, confirm the account holding the list is included
  2. A token scoped only to zones cannot reach account-level lists no matter which zones are selected

Confirm Which Account Holds the List

  1. In the Cloudflare dashboard, go to Manage Account > Configurations > Lists
  2. Confirm the list is in the same account the token is scoped to

For the full setup, see the Cloudflare IP lists page.

Still Having Issues?

We can help you out, contact us at [email protected].