Module and release scope
This guide covers Cloudflare Registrar 1.0.0, Extension API 1, from the reviewed product source. Its declared core range is 1.3.6–1.3.99. Use the matching released core and signed provider package; a version label alone does not install the required contracts. Source availability does not mean the module is bundled in every currently downloadable product, installed on your server, enabled or certified for your merchant/server account. Nothing in this guide enables a provider or changes your existing connections.
Open System → Domain registrars (newer source may group these as Payments, Domain services or Hosting services). Install the reviewed signed package through Modules & addons or the integration workspace's Install tab, enable the module separately, add an account/connection, save its own credentials, run its stated Test and explicitly enable the connection. Saving or retesting disables the connection until you enable it again. Start with the provider's test environment where supported; otherwise use an isolated account or server.
Exact connection fields
These are the fields declared by this module. Secret values are entered privately and encrypted by the application. Defaults are configuration hints, not approved live merchant settings. Internal fields are populated by the module and are not operator-editable.
| Key / label | Type | Required | Default / guidance |
|---|---|---|---|
account_id — Cloudflare account ID |
text | Yes | Use the account-specific value described below. |
api_token — Account API token with Registrar permissions |
secret | Yes | Use the account-specific value described below. |
allow_writes — Allow domain registrations and transfers |
boolean | No | Default: false |
allow_cloudflare_dns — Accept Cloudflare nameservers and manual contact/DNS review |
boolean | No | Default: false Cloudflare Registrar requires Cloudflare DNS. This API does not expose contact or nameserver readback; activation requires review. |
This is an adapter for Cloudflare's public Registrar API beta. It is distinct from a Cloudflare DNS module. Installation leaves it disabled, with purchases and the Cloudflare-DNS acknowledgment disabled. No account data or default payment method is copied into the product source.
Configure
- Find the intended Cloudflare account ID and create an account-scoped API token with the Registrar permissions needed for your operations. Use a restricted token instead of the global API key. Read permissions are needed for tests and sync; Registrar write permission is needed for registrations and transfers.
- Configure the account's billing profile and default payment method in Cloudflare. Complete its registration agreement and required account/contact verification. Successful live registrations are billable and non-refundable under the provider's terms.
- Create the connection with the encrypted token and 32-character account ID. Test reads
GET /accounts/{id}/registrar/registrations. It creates no registration. - Review the DNS restrictions below before enabling Accept Cloudflare nameservers and manual contact/DNS review. Enable purchases separately only after that review. No webhook URL is required by this adapter.
The origin is fixed to https://api.cloudflare.com/client/v4/. The module does not reuse a DNS token unless that token actually has the required account Registrar permissions. It does not assume the beta is enabled for every account or TLD.
Available operations and limits
| Operation | Support |
|---|---|
| Real-time standard domain availability | POST /accounts/{id}/registrar/domain-check |
| Standard registration, 1–10 requested years | POST /accounts/{id}/registrar/registrations |
| Incoming transfer | POST /accounts/{id}/registrar/registrations/{domain}/transfer-in |
| Exact account registration status/expiry | GET /accounts/{id}/registrar/registrations/{domain} |
| Manual renewal, custom nameservers, contact update, lock change, EPP-code retrieval | Not exposed by this adapter; use Cloudflare's dashboard |
The API's registration update currently only exposes provider auto-renewal. That setting is not a manual paid-invoice renewal. This module therefore refuses the billing renewal action instead of turning on future provider charges. It sends auto_renew=false for new registrations and incoming transfers.
The owning customer's canonical registrant is always sent inline as contacts.registrant; it never falls back to the operator account's default registrant. Optional input.contact_extensions and input.acknowledgements carry explicit registry eligibility and fee-agreement values. The adapter does not create legal acknowledgments. Transfers use the customer's plain authorization code and encode it as base64 as required by Cloudflare. Premium purchases and unsupported TLDs are excluded from ordinary registration.
Cloudflare DNS and manual activation
Cloudflare Registrar requires Cloudflare nameservers. Custom hosting-panel nameservers cannot be applied. The requested nameserver list must contain the domain's assigned *.ns.cloudflare.com servers and must be reviewed in Cloudflare. Hosting nameservers are rejected before a purchase; no silent DNS substitution occurs.
The registration read API exposes account registration state and expiry, but it does not return the customer's registrant record or assigned nameserver values. As a result, a customer registration or transfer is submitted once and remains pending manual contact/DNS review, even if its registration workflow finishes. Synchronization reports this limitation explicitly and does not claim the missing values were verified. An administrator must check the intended registrant, assigned DNS and provider completion before manually completing activation. This package is consequently not suitable as a fully automatic registrar for hosting orders that use external DNS.
Domain registration alone does not create a Cloudflare DNS zone. Configure the required zone and records in Cloudflare before a transfer and review the beta's extension-specific prerequisites.
Errors and recovery
Immediate provider errors and workflow failures appear as safe diagnostics. A timeout after submission remains submitted and unconfirmed; no automatic retry occurs. The adapter never follows provider-supplied workflow URLs to another host. TLS is verified, redirects are disabled, every request has timeouts, compressed responses are refused, and responses are limited to 2 MB. Authentication headers, customer contacts and encoded authorization codes are redacted.