The system for inviting people into a Cloudflare account with permissions limited to the job they do; roles are defined across three scopes — account, domain and resource.
What are Cloudflare member roles?
Cloudflare lets you invite other people into your account without sharing a password. The invited person signs in as themselves and can only do what their role permits. To send an invite, the inviter must hold the Super Administrator role and have a verified email address (Cloudflare Docs).
A permission is not a single checkbox but a policy: who receives it (actor), the scope it applies to (resource group) and what may be done within that scope (permission group, i.e. roles) (Cloudflare Docs). One detail matters: a member's effective permissions are the union of what is granted directly and what is inherited through groups — permissions stack rather than constrain.
Three scopes, and picking the right role
- Account-scoped roles apply across the whole account: Super Administrator, Administrator, Administrator Read Only, Billing, Analytics, Audit Logs Viewer, Cache Purge, DNS and Minimal Account Access.
- Domain-scoped roles apply to a single domain in the account — the way to narrow access when you run several brands or separate production from staging.
- Resource-scoped roles limit permissions to one specific resource such as an application or a tunnel; Cloudflare marks this scope as beta (Cloudflare Docs).
The practical rule: the role should equal the job. Analytics for someone who only reads reports, Cache Purge for someone who clears cache after releases, DNS for someone handling domain records. Super Administrator also manages members and billing, so granting it externally needs a strong reason.
For how this compares with the Cloudflare partnership model, see our access management article.
Frequently asked questions
Which Cloudflare role should I give my agency?
The one closest to the work. Analytics if they read reports, Cache Purge if they clear cache, DNS if they manage domain records, Workers Platform Admin if they publish the site on Cloudflare, Administrator Read Only if they only audit the setup. Super Administrator also covers members and billing, so keeping it in-house is the safer default.
I granted a narrow role — can they still have more access than I think?
Yes. Cloudflare permissions work as a union: the role you assign directly is added to any roles inherited from groups the person belongs to. The Members view shows only directly assigned policies, so to see effective permissions you also need to check group memberships.
Related concepts
API Token
An access key issued to a tool rather than a person, scoped in advance to specific actions and resources, and revocable on its own.
Cloudflare
The infrastructure provider that sits between your domain and your visitors, bundling DNS, CDN, caching, SSL and bot protection into a single dashboard.
Cloudflare Partnership
The Tenant structure that lets parties holding a Cloudflare partner agreement provision and manage Cloudflare accounts on behalf of their customers.