The Tenant structure that lets parties holding a Cloudflare partner agreement provision and manage Cloudflare accounts on behalf of their customers.
What is Cloudflare partnership?
The technical expression of a Cloudflare partnership is the Tenant structure. Cloudflare describes the Tenant API as a provisioning mechanism helping Channel and Alliance partners set up and manage Cloudflare accounts and services for their customers (Cloudflare Docs). It is not a dashboard toggle; it is the technical side of a commercial relationship between two companies.
The mechanics: once a partner agreement is signed, Cloudflare creates a dedicated Tenant account and adds the partner's user to it as a Tenant admin. Tenant admins become the default Super Administrator for every account and zone inside the Tenant (Cloudflare Docs). The partner then provisions and manages customer accounts through the API or the dashboard.
Who it fits — and who it doesn't
The model is designed for parties that must provision and operate many customer accounts consistently: hosting providers, managed service providers and large integrators. For a single brand with a single domain, the abstraction it introduces is larger than the problem it solves.
- Partnership is a precondition, not a preference: without a signed agreement with Cloudflare, the Tenant structure is not available.
- The default permission is the widest, not the narrowest — a Tenant admin is Super Administrator on every account inside.
- If the partner created the account, ending the relationship makes handover a technical work item, so ownership and handover terms belong in the contract.
For the vast majority of brands the practical answer is scoped member roles; the full comparison is in our access management article.
Frequently asked questions
Can my agency become a Cloudflare partner?
Not by deciding to. The Tenant structure rests on a signed partner agreement with Cloudflare; after that agreement, Cloudflare creates a dedicated Tenant account and adds the partner's user as a Tenant admin. That is why, in most brand–agency relationships, the workable route is a member invite with a scoped role.
Who owns the account under the partner model?
Because the account is created inside the Tenant structure, the Tenant admin is its Super Administrator by default. How much of the dashboard the brand can reach, and how the account is handed over when the relationship ends, are contractual questions rather than technical defaults — which is why they belong in writing from the start.
Related concepts
Cloudflare
The infrastructure provider that sits between your domain and your visitors, bundling DNS, CDN, caching, SSL and bot protection into a single dashboard.
Cloudflare Member Roles
The system for inviting people into a Cloudflare account with permissions limited to the job they do; roles are defined across three scopes — account, domain and resource.