Use the official cf CLI (npm i -g cf) for every Cloudflare action. Never Wrangler, an S3 SDK script or raw calls to api.cloudflare.com; if cf cannot do something, say so and stop. The Cloudflare connector in Claude can help for reads, but changes go through cf.

cf --version                 # missing: run the setup-cloudflare skill
cf auth whoami               # must say "authenticated": true
cf auth login                # OAuth in the browser, the user grants every scope, sensitive ones included

When cf stops with "More than one account available", run cf accounts list and export CLOUDFLARE_ACCOUNT_ID=<id> for the session. Zone commands take -z <domain or zone id>. Never print tokens or read the cf config file.

Find any command instead of guessing it, with generic queries (action + resource type, no names or ids):

cf cli search "<what you want to do>"     # JSON matches
cf <discovered command> --help              # flags of that command
cf schema <command without the leading cf>  # exact API request body

The commands used most: