Cloudflare

Airia's Cloudflare connector is a Shadow AI connector: it analyzes your Cloudflare Zero Trust Gateway DNS and HTTP logs to detect which AI services your users are reaching, and surfaces them in the Shadow AI inventory. It is not an agent connector and it does not inventory Workers AI or AI Gateway resources as assets.

Two consequences worth setting up front:

• You need Cloudflare Zero Trust Gateway in use, with DNS/HTTP logging on, and real user traffic flowing through it. On an account with no Zero Trust Gateway traffic, the connection is healthy but discovers nothing (there are no logs to analyze).
• The Zero Trust Gateway here is a different Cloudflare product from AI Gateway; creating an AI Gateway does not produce anything for this connector to discover.

Authentication model

A Cloudflare API token plus your account ID.

Required API token scopes

Create a token with these account-level scopes:

The Zero Trust Gateway (Read) scope is the important one: the connection will authenticate with just the other three, but the connection test reports a warning that it "cannot read Gateway rules," and without Gateway read the analysis has no logs to work with. Include Account → Gateway → Read for the connector to actually function.

Customer-side setup steps

1. In the Cloudflare dashboard, copy your Account ID (right sidebar of the account home, a 32-character hex string).
2. Go to My Profile → API Tokens → Create Token, use a custom token, and add the three read scopes above at Account level.
3. Create the token and copy it.
4. In Airia, go to Discover → Connections → Cloudflare and create a new connection with the account ID and token.

Form fields the Airia UI asks for

One connection per tenant

Cloudflare is the one connector limited to a single connection per Airia tenant. If you need to switch to a different Cloudflare account, delete the existing connection first, then create the new one. Attempting a second Cloudflare connection is rejected (the existing connection is preserved).