Connect Cloudflare

Connect Cloudflare usage-based charges with a Billing Read account token and see credits and unpaid debt.

Connect Cloudflare

Bring Cloudflare's usage-based charges (Workers, R2, D1, Workers AI and more) into CostGlass with a read-only account API token.

Where in CostGlassSettings → Cloud Accounts → Cloudflare

PlanDepends on your plan's connection limit

Who can do thisA Cloudflare account administrator, and an owner or admin in CostGlass

Time neededAbout 5 minutes

In short

You create an Account API token with a single permission, Account → Billing → Read, and paste it with your 32-character Account ID.
CostGlass reads Cloudflare's Billable Usage API, which is in alpha. It covers usage-based charges on self-serve (pay-as-you-go) accounts only.
Fixed-fee plans such as Pro or Business, and Enterprise contract accounts, are not in that feed, so a connected account can legitimately show no spend.
CostGlass says so when nothing comes back. It never invents a figure.
The card can also show your remaining Cloudflare credit and any unpaid invoices.
You can connect several Cloudflare accounts. Each account can be connected once.

What is and is not covered

Be clear about this before you connect, because it decides whether you will see numbers.

Cloudflare billing	Shown in CostGlass?
Usage-based charges on a self-serve (pay-as-you-go) account: Workers, R2, D1, Workers AI, Vectorize, Images, Stream and similar	Yes
Fixed-fee plan subscriptions (for example a Pro or Business plan)	No. They are not in the feed.
Enterprise contract accounts	No. They are not in the feed.
A free account with no usage-based products	Nothing to show. It connects and reports that no usage was found.

Alpha API

Cloudflare describes its Billable Usage API as alpha and says it is not yet claiming full conformance with the FOCUS billing standard. CostGlass stores what Cloudflare sends and never fills in the rest, so the data may change as Cloudflare develops the API.

Before you begin

A Cloudflare account where you can create Account API tokens.
Your Account ID (see below).
An owner or admin account in CostGlass, and room in your plan for another connection.

Step by step

Create a billing-read token

In the Cloudflare dashboard open Manage Account → Account API Tokens → Create Token and choose Create Custom Token. Add one permission: Account → Billing → Read. Nothing else is needed and CostGlass never asks for write access. Create the token and copy it straight away; Cloudflare shows it once. Use an Account token, not a user token, and create it for the account you want to connect.

Copy your Account ID

On Account Home open the ⋯ menu next to the account name and choose Copy account ID. It is exactly 32 characters made of the digits 0-9 and the letters a-f.

Connect it in CostGlass

Go to Settings → Cloud Accounts → Cloudflare. Optionally change Account Display Label, paste the 32-character value into Account ID, paste the token into API Token and click Connect Cloudflare. It reads Verifying & Syncing... while it works. To add another account later the button reads Connect Another Account.

Cloud Accounts → Cloudflare.

Note

The Connect button stays disabled until the Account ID looks valid (32 hexadecimal characters). CostGlass checks this before it makes any request, so a mistyped or malicious value cannot be sent to Cloudflare.

What CostGlass checks when you connect

CostGlass asks Cloudflare for the account's billable-usage information. That one call proves the token is valid, has Billing → Read on that account, and that the Account ID is right. If any of that is wrong you see a message and nothing is stored. The token is saved only in CostGlass's encrypted secrets store.

You then see one of two results:

Result	What you see	Meaning
Usage found	A "Cloudflare Successfully Connected!" panel, then the card with a record count.	Usage-based charges were read.
No usage found	A warning panel, "Cloudflare connected, no usage found yet", with Cloudflare's own answer.	The token is valid, but Cloudflare returned no usage-based billing. The account stays connected and is picked up automatically once Cloudflare reports usage.

About the “covered” flag

Cloudflare's information call includes a field called covered, which its documentation does not define. A non-Enterprise account has been seen to report covered=false and still have a valid token. For that reason CostGlass never treats it as a yes or no. It always tries to read usage, and decides from what comes back. The "no usage found" message quotes what Cloudflare said (for example "covered=false, 0 subscription(s)") and lists the possible reasons, without claiming which one applies to you.

What data you will see

Cost per Cloudflare product, split by zone (your domain) where Cloudflare gives one, so you can see which zone a charge belongs to. In CostGlass the zone appears as the resource.
Daily figures where Cloudflare reports daily charges, plus monthly totals for each complete calendar month.
The current month is shown month to date. A monthly total is written only for a calendar month the fetched data fully covers, so a partial sync cannot overwrite a correct full month.
A rough product category for each service (for example Workers is Compute, R2 is Storage, D1 is Databases, Workers AI is AI and Machine Learning). This is CostGlass's mapping, not Cloudflare's.
The first sync looks back through up to 14 of your Cloudflare billing periods; later syncs refresh the latest three.
What is actually billed is used as the cost. A product that billed nothing stores nothing.

Cloudflare's billing period starts on an anchor day of your own, but CostGlass reports in calendar months to match every other cloud, so a figure for a month may be built from parts of two Cloudflare billing periods. Costs show up in Cost Explorer and Reports next to your other clouds.

Credits and unpaid-debt badges

Each sync also reads two small pieces of account information, so the Cloudflare card can show financial signals alongside spend. They are best effort: if one fails the sync still succeeds, and they show even for an account that has no usage yet.

Credit badge: Shown when the account has a credit. It reads like "Credit US$50.00 of US$100.00 · 50% used · 276 days left". Hover for the dates the credit is valid and, when Cloudflare provides it, the date it is projected to run out.
Unpaid badge: Shown when Cloudflare reports unpaid invoices. It reads like "Unpaid US$123.45 · status". Hover to see how many invoices and the status Cloudflare gives.

Billing history is deliberately not imported

Cloudflare's billing-history feed also holds fixed-fee plan charges, but it does not document its transaction types or whether refunds are negative. Turning it into cost figures would mean guessing and could double count usage, so CostGlass does not read it. This means fixed-fee plan spend stays missing from CostGlass.

Syncing, several accounts, disconnecting

CostGlass syncs every six hours. Click Sync Now on the Cloudflare tab to sync all your connected Cloudflare accounts now.
Each account appears as its own card. One Cloudflare account can only be connected once to your organisation, but you can connect several different accounts.
Disconnect asks you to confirm, stops syncing and deletes the stored token. Cost data already collected is kept.

Questions people ask

It connected but shows no spend. Is something broken?

Probably not. If the account only has a free or fixed-fee plan, or is an Enterprise contract account, the usage feed has nothing to report. Once you use a usage-based product on a self-serve account, CostGlass picks it up.

Where do my Pro or Business plan charges go?

They are not in the usage feed, so CostGlass does not show them yet.

Can I use a user API token?

Use an Account API token created for the account you want to connect, with Account → Billing → Read.

Can I connect the same account twice?

No. You will get a message that it is already connected.

My token is rejected.

Check it has Billing → Read on this account, that it has not expired and that the Account ID belongs to the same account.

All Documentation Guides

Welcome to CostGlass — What CostGlass does, who it is for, how your data gets in, the plans and regions, and a plain-English glossary.
Quickstart: your first hour — Sign up, connect a first cloud, invite your team, set a budget and turn on anomaly alerts, with a first-week checklist.
Finding your way around — A tour of the sidebar, top bar and page controls: what every page answers, plan gating, currency, language, links and caching.
Dashboards — The Overview dashboard widget by widget, plus building custom dashboards you can share with your organisation.
Cloud Resources — The multi-cloud inventory: filters, search, categories, estimated cost, terminated resources and CSV or Excel export.
Uptime, incidents & support requests — Monitor public endpoints, route alerts, see incidents and raise requests to CostGlass engineers.
How CostGlass accesses your data — Security and data ingestion architecture: how CostGlass reads multi-cloud billing and telemetry through read-only roles and least-privilege permissions.
Dashboard & Platform Screenshot Tour — Visual walkthrough of the CostGlass interface with screenshots covering multi-cloud spend, Cost Explorer, anomalies, Kubernetes allocation, and savings.
Connecting your clouds: overview — Every cloud and service you can connect, how each one connects, what access it needs, how long data takes and your plan limits.
Connect AWS (CloudFormation) — Deploy the generated CloudFormation template, choose organization or single account and optional features, then verify.
Connect AWS with Terraform instead of CloudFormation — A Terraform equivalent of the generated AWS template, with an Organization variant and a way to compare it to the wizard.
Connect Azure — Admin consent for the CostGlass application, Reader and Cost Management Reader roles, management group or subscription scope, and a Terraform version.
Connect Google Cloud — Enable the FOCUS BigQuery export, run the IAM grants CostGlass prints, verify, and a Terraform version.
Managing connected accounts — The Cloud Accounts page: statuses, syncing, errors, naming, disconnecting, and the FOCUS 1.0 and CUR Export pages.
Connect Oracle Cloud (OCI) — Give CostGlass read-only access to Oracle Cost and Usage Reports with a Resource Manager stack or your own Terraform.
Connect Alibaba Cloud — Connect Alibaba Cloud through Bill Subscription files in OSS and a read-only RAM role created by a ROS template.
Connect DigitalOcean — Connect DigitalOcean accounts with a read-only personal access token and see invoices by month.
Connect Akamai / Linode — Connect Linode (Akamai Connected Cloud) accounts with an account read-only token.
Connect Cloudflare — Connect Cloudflare usage-based charges with a Billing Read account token and see credits and unpaid debt.
Connect OpenAI, Anthropic, Datadog and Snowflake — Connect AI and software vendors with admin keys or a Snowflake key pair so their spend sits beside your cloud costs.
Cost Explorer — Slice, compare and drill into spend across every connected cloud: group by, filters, charts, overlays, details, AI, links and export.
Saved views, saved filters & scheduled emails — Keep, share and email the Cost Explorer views you use often, and reuse include/exclude filters across views and reports.
Reports — Build, compare, export, save and schedule spend reports, with presets, Excel, CSV and PDF exports.
SaaS & AI Spend — Spend and token analytics for OpenAI, Anthropic, DeepSeek, Datadog, Snowflake and cloud AI services.
Unit Economics — Cost per business unit: define metrics, send volumes, set targets and alerts.
Connect a Kubernetes cluster — Install OpenCost and the CostGlass exporter in your cluster so cost data is pushed to CostGlass every 15 minutes.
Kubernetes Costs page — Understand cluster, namespace, workload and pod costs, idle capacity, rightsizing, carbon and health.
Tagging strategy: getting the most from tags — How to tag cloud resources, enforce tagging, and when to use cloud tags or virtual tags in CostGlass.
Tag Explorer — Group billed spend by the value of a tag, see tag coverage per cloud and drill into resources.
Tag Compliance — Define required AWS tags, measure compliance, and fix missing tags with Quick Tag, batch apply or a CLI script.
Virtual tagging — Allocate spend by team, product or environment with rules, no cloud changes, with a rule builder and CostGlass AI.
Forecasting — Forecast month-end spend, the next months and a yearly run-rate, and simulate the cost of changes.
Budgets — Create spending limits for a cloud, account, service or team, and see how CostGlass budgets differ from native AWS, Azure and Google budgets.
Anomaly detection — How CostGlass finds unusual daily cost, how to tune it, explain it and be notified.
Cost alerts — Alert when spend rises versus the previous day, week, month or quarter.
All alert and notification types — A comparison of every alert and notification in CostGlass, with channel setup and testing.
Issues & annotations — Dated notes on spend, and a lightweight issue tracker for cost work with Jira push.
Savings playbook — A prioritised, step-by-step programme for reducing your cloud bill, with a 30/60/90-day plan.
Savings recommendations — How the Savings page finds, prices and tracks savings for every connected cloud and platform.
Rightsizing — Find servers and databases that are too big, or too small, using real CPU and memory measurements.
Commitments: Savings Plans & Reserved Instances — Track coverage, utilisation, expiry and purchase recommendations for Savings Plans, Reservations and committed use discounts.
Instance Scheduler — Start and stop non-production servers on a weekly schedule to stop paying for idle hours.
Giving your team access — Invite people, choose Owner, Admin or Member roles, remove users and limit what they see.
Setting up your organisation hierarchy — Build a tree of nodes, place cloud accounts by hand, rule or CSV, and scope people to a branch.
Designing your hierarchy (with enterprise examples) — Principles and worked patterns for AWS Organizations, single accounts, multi-cloud groups, MSPs and regulated regions.
Single sign-on (SAML & OIDC) — Connect Okta, Entra ID, Google Workspace or another provider, verify your domain, test and require SSO.
API keys & AI assistants (MCP) — Create API keys and connect Claude Desktop, Cursor or Claude Code to your cost data.
Audit log — See who changed what and when, with before and after values, kept for 24 months.
Data residency & retention — Your fixed region, how long cost history is kept, purge now and the data handling summary.
Notification settings, Jira & chat — Weekly spend summary, Slack and Teams webhooks, and connecting Jira Cloud.
Troubleshooting & Common Setup Fixes — Solutions for common cloud connection and ingestion issues across AWS, Azure, Google Cloud, OCI, Alibaba Cloud, Kubernetes, and SSO.

Connect Cloudflare