DigiUsher DocumentationConnecting a Cloudflare account
Connect your Cloudflare account to DigiUsher with an Account ID and a read-only Billing API token to track usage-based spend across Cloudflare products.
Overview
To onboard your Cloudflare account to DigiUsher, you create a scoped API token with Billing: Read permission in the Cloudflare dashboard, then provide it along with the Account ID to DigiUsher. This document describes exactly what access is requested, why it is needed, and what credentials to provide.
Self-serve Cloudflare accounts only
A Cloudflare self-serve account is required. DigiUsher does not currently support Cloudflare Enterprise contract accounts. If you are on an Enterprise contract, this integration is not available for your account at this time.
Summary of Access Required
| Component | Details |
|---|---|
| Identity | Cloudflare API Token — scoped read-only, programmatic access only |
| Access level | Read-only — account-level billing and usage data |
| Data | Daily billable usage per product per billing period |
| Scope | A single Cloudflare account (identified by Account ID) |
| Capability | What It Provides |
|---|---|
| Spend by product | Workers, R2, D1, Workers AI, Vectorize, Images, Stream, and others |
| Usage quantities | Requests, duration, storage, and bandwidth (product-dependent) |
| Credit rows | Negative-value rows captured as credits |
DigiUsher cannot send traffic, modify DNS records, alter zones, or change any Cloudflare configuration.
Prerequisites
Information to Gather
| Item | How to Find | DigiUsher Field |
|---|---|---|
| Account ID | Shown on the token confirmation page after creating the API token (Manage Account → API Tokens → Create Token → confirmation page) | account_id |
| API Token | Cloudflare dashboard → Manage Account → API Tokens → Create Token → Custom token → Permission: Account > Billing > Read → include your account under Account Resources (shown once at creation — store securely) | api_token |
Roles Required by the Person Performing Setup
| Role / Permission | Why |
|---|---|
| Account Administrator or Super Administrator | Only these roles can create API tokens on a Cloudflare account. |
Network & Email Access (For Regulated Environments)
If your organization restricts outbound internet access or email domains, ensure the following are in place before starting:
- Domain allowlist: Add
*.digiusher.comto your network/firewall allowlist so that users in your organization can access the DigiUsher platform from their browsers. - Email allowlist: Add
digiusher.comas an approved sender domain in your email security gateway. DigiUsher sends onboarding confirmations, alerts, and reports from@digiusher.comaddresses.
Setup
Create an API Token
Create a dedicated, scoped API token for DigiUsher.
-
In the Cloudflare dashboard, open Manage Account → API Tokens.
-
Click Create Token → choose Custom token.
-
Give the token a recognizable name, for example
digiusher-billing-read. -
Under Permissions, add:
Account→Billing→Read. Do not select Edit — Read is sufficient and is the minimum required.
-
Under Account Resources, select Include → Specific account → <your account> (or Include → All accounts if you prefer).
-
Optionally set an expiration date or IP address filter for additional security.
-
Click Continue to summary, then Create Token.
-
On the confirmation page, copy both the API token and the Account ID shown on the same page — the token is shown only once.
Save your credential
The API token is shown only once at creation and cannot be retrieved again. Copy and store it securely — you will enter it into DigiUsher in the next section.
Confirm What You Have
Before moving on, verify:
- You have the Account ID (starts with
cfat_). - You have the API token created with
Account > Billing > Readpermission.
Connect in DigiUsher
After completing the steps above, enter the following into DigiUsher to complete the connection:
| Field | Where to Find |
|---|---|
| Connection Name | Any label you prefer, for example Cloudflare Production |
| Account ID | From Step 1 |
| API Token | From Step 2 |
When you connect, DigiUsher validates the token against your account and begins importing billing data. The first sync covers the current billing period and recent history. After that, DigiUsher ingests new usage data daily.
Verification Checklist
- Paid Cloudflare self-serve account (Enterprise contracts not supported)
- Account Administrator or Super Administrator role
- Account ID located and copied
- API token created with
Account > Billing > Read(not Edit) - API token saved securely
- Account ID and API token entered in DigiUsher
-
*.digiusher.comallowlisted in your network/firewall (if applicable) -
digiusher.comallowlisted as an approved sender domain in your email security gateway (if applicable)
Security
What DigiUsher CAN Access (Read-Only)
- Billable usage data per product, per billing period
- Usage quantities by product (requests, storage, bandwidth, duration)
What DigiUsher CANNOT Do
- Send traffic, modify DNS records, zones, Workers, or any Cloudflare resource
- Create, rotate, or delete API tokens
- Access log content, request payloads, or user PII
- View or modify payment methods, plan settings, or billing contacts
- Make purchases or any changes to your account
The API token is stored encrypted at rest and is never returned in DigiUsher API responses.
Monitoring
Review tokens at Manage Account → API Tokens. Confirm which tokens exist and when they were last used. Remove any tokens you no longer recognize.
Credential Rotation
- In the Cloudflare dashboard, create a new API token with
Account > Billing > Read. - Update the token in DigiUsher immediately.
- Delete the old token from the Cloudflare dashboard.
Avoid ingestion gaps
Always create the new token and update DigiUsher before deleting the old one to avoid an interruption in data ingestion.
Revocation
Delete the API token at Manage Account → API Tokens. This immediately invalidates the token and stops all access. DigiUsher will no longer be able to ingest billing data until a new token is provided.
Troubleshooting
403 / invalid token
Confirm the token has Account > Billing > Read permission (not Edit, and not a different permission category). Re-create the token in the Cloudflare dashboard and re-enter it in DigiUsher.
Account ID not recognized
Confirm you copied the Account ID (a 32-character hex string), not a Zone ID. Zone IDs look similar but are scoped to a single domain. Retrieve the Account ID using one of the three methods in Step 1.
No billing data or incomplete data
Cloudflare billing data is finalized per billing period. Usage mid-period may not yet be reflected. DigiUsher syncs daily and backfills as data is finalized.
Token restricted by IP filter
If you set an IP address filter on the token, confirm DigiUsher's egress IPs are included. Contact DigiUsher support for the current egress IP list.
Need Help?
If you encounter any issues not covered above, contact DigiUsher support at support@digiusher.com and the team will help you get set up.
Connecting a ChatGPT Enterprise or Edu account
Connect your ChatGPT Enterprise or Edu organization to DigiUsher with an Admin API key and Organization ID to track AI spend and usage across your organization.
Connecting a Claude.ai account
Connect your Claude.ai Enterprise organization to DigiUsher with an Analytics API key to track AI spend and usage per user and per model.