Resource Tagging

Resource Tagging lets you attach key-value pairs to a wide range of Cloudflare resource types including zones, custom hostnames, Cloudflare Tunnels, Workers, D1 databases, R2 buckets, KV namespaces, and more. Tags are stored separately from the resources themselves, enabling cross-resource queries and policy enforcement without modifying underlying resource configurations.

Tags are simple key-value string pairs stored as a JSON object:

{
  "environment": "production",
  "team": "platform",
  "region": "us-west-1"
}

You manage tags through the Tagging API using GET, PUT, and DELETE operations. The API supports filtering resources by tags with AND/OR logic, negation, and key-only matching.

Authentication uses Account Owned Tokens (AOTs), which are account-level tokens independent of individual users.

• The dashboard is in beta. You can view and manage tags in the dashboard under Manage Account > Resource Tagging, but the API remains the recommended interface for automation workflows.
• PUT replaces all tags. There is no PATCH endpoint. The PUT operation replaces all tags on a resource. Use the GET, merge, PUT workflow to modify individual tags.
• DELETE removes all tags. There is no way to delete a single tag. Use PUT with the remaining tags instead.
• Querying tags for a resource that has never been tagged returns a 500 error instead of 404. This is a known beta limitation.

Follow the Get started guide to set up authentication and make your first API calls.