• Why a relay? Cloudflare's management API (api.cloudflare.com) does not support browser CORS — requests carrying your Token trigger an OPTIONS preflight, which Cloudflare rejects with HTTP 400 and no CORS headers, so a pure front-end call is blocked by the browser. That's why requests go through our backend relay (server-side calls have no CORS restriction).
• Where does the Token go? The browser sends the Token to our backend (api.oc.5666.online/api/cf-proxy), which injects Authorization: Bearer and forwards it to Cloudflare. Our backend only relays — it never writes the Token to the database nor logs it.
• Can our site touch your DNS? No. The backend is just a stateless pipe that forwards the Token you provide as-is; it does not hold or understand your Token, and without it cannot make any request to Cloudflare.
• Use an API Token, not the Global API Key. A Cloudflare API Token can be scoped to specific permissions and Zones, so its blast radius is far smaller than the global key. Create a Token with only Zone · DNS · Edit permission, scoped to the specific domain.
• Principle of least privilege: Do not grant Account-level permissions or use the global API Key; authorize only when you need to manage that domain's DNS, and revoke it anytime from the Cloudflare dashboard.
• Leaked Token = your DNS can be changed. Anyone with the Token can add, delete, or edit that Zone's records and toggle the orange cloud, which may lead to DNS tampering or traffic hijacking. Do not save the config on public or shared computers; clear it before you leave.

To clear local config: empty the input boxes above and click “Save config” to overwrite it; or clear this site's data entirely (this also clears other local settings).