Creating a read-only Cloudflare API token for Nexum

This token only needs DNS-read access to the one domain you're auditing — nothing else.

1. Go to dash.cloudflare.com and log in.
2. Click your profile icon (top right) → My Profile.
3. Open the API Tokens tab.
4. Click Create Token → Create Custom Token.
5. Give it a name you'll recognize, e.g. "Nexum audit — DNS read".
6. Under Permissions, choose Zone / DNS / Read.
7. Under Zone Resources, choose Specific zone, and select the single domain you're auditing.
8. Click Continue to summary → Create Token.
9. Copy the token value immediately — it's shown only once.