TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

API Management

4 posts · Sep 2011 – Sep 2026

What this trail covers

Cloudflare's API management has evolved to enforce positive security policies for web applications and APIs through Application Profiles. This feature analyzes traffic structure and format to identify deviations from learned expected request patterns, allowing for the creation of rules to block non-conforming requests. It extends existing API security capabilities by applying schema learning and validation to web assets, providing an always-on detection layer that enriches requests with metadata. The Monetization Gateway further enhances API management by enabling per-use charging for API access, leveraging the HTTP 402 status code and stablecoin transactions for agent-native payments. This allows for flexible pricing schemes and direct payment settlement for API consumption, aligning business models with agent consumption patterns.

All Cloudflare trails
  1. Monetization Gateway beta: charge AI agents for consumption with HTTP 402This post introduces the Cloudflare Monetization Gateway, a new capability that allows sellers to charge agents for API access using the HTTP 402 status code and stablecoin transactions. It details the architecture, which uses Coinbase's x402 Facilitator for payment settlement on the Base blockchain with USDC. The post showcases four customer use cases: Cloudflare AI Gateway (paying for inference), Ceramic.ai (paying for web search), Stocktwits (paying for stock signals), and API2PDF (paying for API access). The Monetization Gateway integrates with existing pricing engines and offers flexible pricing schemes, including per-request and fixed pricing.
  2. Enforce positive security with Cloudflare Application ProfilesThis post introduces Application Profiles, a new feature that extends positive security to web applications by learning and enforcing expected HTTP request structures. It details the learning process, which analyzes traffic to infer data types and constraints for path variables, query parameters, headers, cookies, and body structures. The feature provides an always-on validation layer that adds metadata to requests, which can then be used in Security Rules for enforcement. It highlights how non-conforming requests, even if not malicious, are identified and can be blocked. The post also explains how to review learned profiles in Security Analytics and create targeted rules based on specific fields or operations. This builds upon existing API security features like Schema Learning and Schema Validation.
  3. Code Mode: give agents an entire API in 1,000 tokensIntroduces a new MCP server for the entire Cloudflare API that leverages Code Mode. This server exports only `search()` and `execute()` tools, which allow agents to discover and interact with over 2,500 API endpoints by writing and executing JavaScript code within a secure Worker isolate. This dramatically reduces token consumption (99.9% reduction for the Cloudflare API) and enables agents to manage complex Cloudflare services. Also open-sources a Code Mode SDK for developers to implement similar approaches.
  4. Code Mode: the better way to use MCPThis post introduces 'Code Mode' for interacting with Model Context Protocol (MCP) servers. Instead of directly exposing MCP tools to LLMs, this approach converts MCP tools into a TypeScript API. This allows LLMs to write code that calls these APIs, leading to better handling of more complex tools and improved chaining of multiple tool calls. The Agents SDK has been extended to support this model, generating TypeScript definitions from MCP schemas and executing the generated code in a secure sandbox. This shifts the LLM's task from direct tool invocation to code generation for API interaction.
  5. Securing data in SaaS to SaaS applicationsThis post introduces a new capability thread focused on securing SaaS-to-SaaS integrations. It details two architectural approaches: proxying SaaS vendor traffic via customer-controlled custom hostnames and proxying all traffic to a SaaS vendor's platform. A core technical innovation described is 'key splitting,' a cryptographic method to divide bearer tokens into two fragments (Part A and Part B). Part A is given to the integration, while Part B is stored by Cloudflare. This prevents either fragment from being used independently, forcing all API calls through Cloudflare's proxy for monitoring, anomaly detection, and instant revocation by deleting Part B. This mechanism provides enhanced visibility and control over data access across third-party integrations.
  7. HTTPS-only for Cloudflare APIs: shutting the door on cleartext trafficThis post details the technical decision and implementation strategy for enforcing HTTPS-only connections on api.cloudflare.com. It explains the security risks of cleartext HTTP requests, even with redirects or 403 responses, by highlighting the exposure of sensitive data during the initial request. The solution involves closing cleartext HTTP ports at the transport layer, providing a fast-failure signal to clients. The post discusses the challenges of implementing this at scale, including the percentage of legacy clients still using HTTP and the limitations of the BSD Sockets API, which Cloudflare addresses with Tubular for flexible endpoint management. The change aims to enhance API security by preventing exposure before it occurs, rather than reacting to it.
  8. Moving k8s communication to gRPCThis post details Cloudflare's migration of internal microservice communication from REST/Kafka to gRPC. It highlights the benefits of gRPC for usability (function-call-like RPCs, protobuf serialization) and performance (HTTP/2 multiplexing, faster protobuf serialization compared to JSON). The post also discusses the security implications and how Kubernetes NetworkPolicies complement gRPC's built-in security features. The DNS team's specific use case of migrating from REST to gRPC for handling large DNS zones is presented as a concrete example.
  9. Sunsetting API v1 In Favor Of CloudFlare’s Current Client API: API v4This post announces the sunsetting of Cloudflare's API v1 and the promotion of API v4. It details the technical differences, including the shift to JSON for both requests and responses, improved namespacing, and the addition of numerous features previously unavailable in v1. Migration documentation and client libraries are provided to assist developers in transitioning to API v4.
  10. CloudFlare Tips: 5 Frequently used CloudFlare API callsThis post introduces the Cloudflare API as a client-facing interface that mirrors many features available in the Cloudflare settings page. It details the necessary prerequisites for API usage (API key, zone ID, account email) and the endpoint for requests. It highlights five commonly used API features: enabling Development Mode, purging the Cloudflare cache, pulling basic statistics, reporting spam, and updating the challenge page screen capture. The post directs users to the Cloudflare Client Interface API documentation for specific calls and parameters.