How to set up Multi-User accounts on Cloudflare

What is a Multi-User account?
Multi-User accounts allow a group of users to share access for managing the settings of a group of websites in Cloudflare. Super-Administrators in a Multi-User account can delegate access to other members, so that not every member can change every Cloudflare setting.

As of May 2, 2018, users in all customer plans received multi-user capabilities in Cloudflare and can share access to their account by accessing

How does Multi-User work?
In Multi-User, an account controls one or more website, and invites users to be able to edit Cloudflare settings on those websites. A user can belong to one or more account, and have different permissions for each account that they belong to.

How do I create a Multi-User account?
All Cloudflare accounts now have Multi-User capabilities. However, the full set of roles available are an Enterprise level feature. To enable all Multi-User roles, get in touch with the Cloudflare sales team

Can a user belong to more than one account?
Yes, a user can belong to more than one account.
Here's an example:

User A is part of two accounts: Orange Cloud and Grey Cloud.

User A has 'DNS' privileges to the 'Orange Cloud' account and 'Firewall' privileges to the 'Grey Cloud' account.

When User A logs into to Cloudflare, they will see all of Orange Cloud's zones, all of Grey Cloud's zones, and all of their personal account zones. They have DNS permissions for all the zones belonging to Orange Cloud, firewall permissions for all the zones belonging to Grey Cloud and Super Admin access to their own zones.

Orange Cloud and Grey Cloud are still totally separate accounts. User A just happens to have been granted access to both of them.

How do I invite people to my account?
1. If you have access to multiple accounts, select the account you want to share from the account selector. Otherwise, just click the Cloudflare logo to go back to your account home.


2. Click the Members tab.


3. Enter the email address of the member you want to invite to your account. If you are an enterprise customer, select the role you'd like to assign to them, then press Invite. For a detailed breakdown of available permissions, see below.


That member will receive an email invitation from Cloudflare to join your account.

What permissions does each Multi-User role have?

There are various permissions that can be chosen, and users can mix and match multiple  permissions per user.   All roles have access to the Overview app.

Role Apps with permissions


(Edit DNS records)

  • DNS


(Edit WAF, IP Firewall, and Zone Lockdown settings)

  • Firewall
  • Traffic


(Read analytics)

  • Analytics

Crypto, Caching, Performance, Page Rules, and Customization

(Edit most Cloudflare settings except for DNS and Firewall)

  • Crypto
  • Speed
  • Caching
  • Page Rules
  • Network
  • Customization

Cache Purge

(Purge the edge cache)

  • Caching

Cloudflare Access

(Edit Cloudflare Access policies)

  • Access

Load Balancer

(Edit Load Balancers, Pools, Origins, and Health Checks)

  • Firewall
  • Traffic

Log Share

(Edit Enterprise Log Share configuration)

  • Logpush (Beta)

Cloudflare Workers

(Edit Cloudflare Workers)

  • Workers


(Access the full account, except for membership management and billing)

  • All the same privileges as Super Administrator, except User Management and Billing

Super Administrator - All Privileges

(Edit any Cloudflare setting, make purchases, update billing, and manage memberships, revoke access of other Super Administrators)

  • All apps


(Edit the account billing profile and subscriptions)

  • Account Home > Billing
  • Profile > Billing

Audit Log Viewer

(Can view audit logs)

  • Account > Audit Logs

Does each user in a account have their own API key?
Yes. Each user has their own API key that spans all accounts. You can retrieve your API key by going to the My Profile page and clicking View API key.


Can accounts enforce Two-Factor Authentication
Yes. In fact, we encourage it!

For any account that you're Super Administrator, you can enable Two-Factor Authentication in the Members tab and toggle Member 2-FA Enforcement to On.


Can I continue to use the old interface and API after switching to Multi-User?
No. Accounts that are using Multi-User lose the ability to go back to the old version of the interface. All accounts will move to the new interface starting on May 22, 2018.

Not finding what you need?

95% of questions can be answered using the search tool. This is the quickest way to get a response.

Powered by Zendesk