Skip to main content
The Cloudflare One connector reads your Zero Trust Gateway analytics through Cloudflare’s GraphQL Analytics API. DNS queries tell it which AI services your devices reach, and HTTP requests tell it who reached them. Each AI service then appears in your Shadow AI discovery findings, counted in DNS/HTTP requests. It works on the Free Zero Trust plan. Openlayer reaches Cloudflare over outbound HTTPS. Nothing needs to reach Openlayer.

​
What Openlayer reads

  • Gateway DNS queries: each queried domain and how many times it was queried per minute. DNS covers every device that resolves through Gateway, but it doesn’t say who.
  • Gateway HTTP requests: each requested host, the user’s email, and how many requests per minute. This is where user identity comes from. See See who used each service.
  • Counts only. Cloudflare’s analytics are already aggregated, so no URLs, pages, prompts, or responses are read.
For each domain, Openlayer uses the HTTP count when there is one and the DNS count otherwise. The two are never added together. Cloudflare is queried live, each time you open Discovery, for the time range you pick. Openlayer stores only your review decisions, never Cloudflare’s data.

​
Prerequisites

  • Shadow AI discovery turned on for your deployment. See Shadow AI discovery.
  • A Cloudflare One (Zero Trust) organization whose devices resolve DNS through Gateway.
  • Someone who can create an account API token in Cloudflare.
  • Someone who can set an environment variable where Openlayer runs. If Openlayer hosts your deployment, that’s us.

​
Set up

1

Create an API token in Cloudflare

In the Cloudflare dashboard, go to Account API tokens and click Create Token. Under Custom token, click Get started, and add one permission: Account → Account Analytics → Read.Create the token and copy it. It can read analytics only. It can’t change anything in your account.
2

Find your account ID

Copy the account ID of the Cloudflare account that runs your Zero Trust organization. See Cloudflare’s guide to finding your account ID.
3

Put the token in an environment variable

Set the token in an environment variable where Openlayer runs, such as CLOUDFLARE_API_TOKEN, and restart Openlayer. If Openlayer hosts your deployment, coordinate with us to set it.The admin portal stores only the variable’s name, never the token.
4

Connect Cloudflare One

In the admin portal, go to Shadow AI → Discovery, click Connect, and choose Cloudflare One. Fill in:
  • Account ID: the ID from the previous step.
  • API token env var: the variable from the previous step. It defaults to CLOUDFLARE_API_TOKEN.
Click Connect. Openlayer checks the token by reading the last 24 hours of your account’s DNS analytics. If the token or account ID is wrong, the error says which.Findings appear as soon as Cloudflare has logged DNS queries to AI services, usually within a minute or two of someone using one.

​
See who used each service

DNS analytics are anonymous, so on their own they show which AI services were reached but not by whom. To attribute usage to people, Openlayer reads Gateway HTTP analytics, which carry the user’s email. That needs three things in Cloudflare One:
  • Devices send HTTP traffic through Gateway. Devices run the Cloudflare One Client (formerly WARP), enrolled in your Zero Trust organization, in a mode that proxies traffic, such as Traffic and DNS mode (the default). DNS only mode sends no HTTP traffic.
  • TLS decryption is on. In Zero Trust, go to Traffic policies → Traffic settings, and under Proxy and inspection turn on Inspect HTTPS requests with TLS decryption. Install the Cloudflare certificate on your devices first. Without decryption, HTTPS requests, which covers almost every AI service, often carry no host, so they can’t be matched to a service.
  • HTTP activity is logged with PII. Under Traffic policies → Traffic settings → Traffic logging, log HTTP activity, and leave Exclude personally identifiable information (PII) from logs off.
The same token works. No new permission is needed. If HTTP analytics are empty or can’t be read, the connector uses DNS alone, and findings show no users.

​
How findings appear

  • Findings are counted in DNS/HTTP requests. A count is the number of requests Cloudflare logged, not prompts or sessions: one page load can make many requests.
  • Per-user figures come from the HTTP email. Usage seen only in DNS has no user.
  • The Discovery page shows the last hour, 6 hours, or 24 hours.

​
Limitations

  • Only devices and networks that resolve DNS through Cloudflare Gateway are covered.
  • Requests your Gateway policies blocked are counted together with allowed ones. Cloudflare findings have no separate blocked-attempts figure.
  • Traffic from a proxy endpoint or a service token, rather than an enrolled user, carries Cloudflare’s placeholder email non_identity@<team-domain>.cloudflareaccess.com, and appears as that user.
  • Busy accounts: when a time range returns more rows than Cloudflare allows in one query, Openlayer splits the range into smaller slices, down to 5 minutes, and queries each.

​
Troubleshooting

Check that the token has Account Analytics: Read and hasn’t expired, and that the environment variable where Openlayer runs holds it. If the variable isn’t set, the connector card says so.After you replace the token, update the environment variable and restart Openlayer.
The token can’t read that account. Check the account ID, and that the token’s permissions include that account.
Identity comes only from HTTP analytics. Check the three settings in See who used each service. If your account redacts PII in its logs, emails may be hidden from analytics as well.
Check that your devices resolve DNS through Gateway, and that someone has used an AI service in the time range you’re viewing. Then widen the range to 24 hours.