---
title: "Start the Cloudflare one-click flow"
method: GET
path: "/api/v1/sessions/{token}/cloudflare/start"
tags: ["One-click flows"]
---

# Start the Cloudflare one-click flow

`GET /api/v1/sessions/{token}/cloudflare/start`

## Request

- Base URL: `https://app.dodomain.io`
- URL: `https://app.dodomain.io/api/v1/sessions/{token}/cloudflare/start`
- Auth: none required

Browser entry point for the tier-1 Cloudflare flow: mints a PKCE pair and a CSRF `state`, binds them to the session, and redirects the end user to Cloudflare's consent page. Navigate to it (a link or a redirect) — do not fetch it from script. One-click is a paid-plan feature: a session created by a Free team was created without it, and this route answers `403 forbidden` for it (the hosted page never shows that session a one-click button).

## Path parameters

- `token` string, required

## Other responses

- `302`: Redirect to Cloudflare's OAuth consent page.
- `403`: `403 forbidden` — The OAuth access token was not granted the scope this operation requires. `details.code` is `SCOPE_MISSING` and `details.requiredScope` names the scope. Secret keys (`dd_sk_`) carry no scopes and never see this for a missing scope. The one-click start routes also answer it for a session created without one-click (a Free-plan team's session): no `details`, and the end user falls back to the manual records.
- `404`: `404 not_found` — The addressed resource does not exist, or the caller does not own it — the two collapse to one status on purpose, so an id cannot be enumerated by a caller who does not own it.
- `410`: `410 expired` — The connect session's 24-hour lifetime has elapsed. Returned before any verification, metering, or webhook work happens.
- `429`: `429 rate_limited` — Rate limited. `Retry-After` (seconds) is set and `details.retryAfterSeconds` repeats it. Branch on `details.reason`: `request_rate` means the caller is calling too fast (`details.limit` carries the cap), `recently_checked` means this one connection was DNS-checked inside its cooldown.
- `500`: `500 internal` — An unhandled server-side failure. Reported to our error tracker; safe to retry.
- `503`: `503 not_configured` — The one-click flow this endpoint starts is not configured on this deployment. The manual-records flow remains available.

---

[API](https://skmtc.dev/dodomain/apis/dodomain-api.md) · [All operations](https://skmtc.dev/dodomain/apis/dodomain-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dodomain/apis/dodomain-api/revisions/44cfb944de58?raw)