Simple CF

An unofficial, native iOS/iPadOS client to manage Cloudflare from a phone or tablet: DNS (full CRUD), read-only Workers/Pages, and Analytics. Authenticates with a scoped API token stored in the device Keychain — no backend, the app talks directly to the Cloudflare API. Not affiliated with or endorsed by Cloudflare, Inc.

Features

• DNS management — browse your zones, then view, search, add, edit, and delete DNS records (A, AAAA, CNAME, TXT, MX) with the proxied (orange-cloud) toggle, TTL control, and MX priority. Destructive actions are confirmed.
• Workers & Pages — read-only list of Workers scripts and Pages projects for the selected account.
• Analytics — per-zone traffic overview with key-metric cards (requests, data served, cache ratio, threats) and a daily requests chart, plus account Web Analytics (page views & visits per site, from Cloudflare RUM). Built with Swift Charts, over a 7- or 30-day window.
• Secure by design — a scoped API token is the only credential, stored in the device Keychain and sent directly to Cloudflare. No backend, no sign-up, no third-party tracking. Optional Face ID / passcode lock gates the app.
• Universal — adapts to iPhone (tab bar) and iPad (sidebar split view); light and dark mode.

Creating your API token

The app authenticates with a scoped API token (not your Global API Key). Create one once, then paste it into the app's Connect screen.

1. Open dash.cloudflare.com/profile/api-tokens.

2. Click Create Token → Create Custom Token (Get started).

3. Under Permissions, add these rows:

   Group	Permission	Access	Used for
   Zone	DNS	Edit	DNS records (CRUD)
   Zone	Zone	Read	Listing your domains
   Zone	Analytics	Read	Traffic analytics
   Account	Account Analytics	Read	Web Analytics (page views)
   Account	Workers Scripts	Read	Workers list
   Account	Cloudflare Pages	Read	Pages list

4. Zone Resources → Include → All zones (or pick specific zones).

5. Account Resources → Include → your account.

6. (Optional) set a TTL or client-IP filter, then Continue to summary → Create Token.

7. Copy the token (shown only once) and paste it into the app.

The token can be revoked or rolled anytime from the same page. The app stores it only in the device Keychain.

Architecture

• CloudflareKit/ — UI-free Swift package (networking, models, Keychain). Compiles and tests headlessly with swift (no Xcode needed).
• CloudflareApp/ — SwiftUI app target (iOS 17+, universal).
• project.yml — XcodeGen spec. The .xcodeproj is generated, not hand-edited.

One-time setup

Xcode is installed but its license must be accepted and the toolchain selected:

sudo xcode-select -s /Applications/Xcode.app
sudo xcodebuild -license accept
xcodebuild -runFirstLaunch

Tooling (via mise): xcodegen, xcodes.

Develop

Common tasks are wrapped in the Makefile (make help lists them):

make test       # run CloudflareKit unit tests (no simulator needed)
make kit        # build the CloudflareKit package
make project    # regenerate the Xcode project from project.yml
make build      # compile the app for the simulator
make run        # build, boot the simulator, install & launch the app
make runtimes   # list installed simulator runtimes
make runtime    # download the iOS simulator runtime (~8.5 GB)

make build/make run require the iOS simulator runtime. If make runtimes shows none, install it from Xcode → Settings → Components (most reliable), or run make runtime in a real terminal. Override the device with make run SIMULATOR="iPhone 17 Pro".

Signing: the bundle id is com.zeyanlin.simplecf and device/App Store builds use automatic signing with the DEVELOPMENT_TEAM set in project.yml. Simulator builds are ad-hoc signed and need no Apple account.