[TIP] User Token API Permissions

[henrycarrero]

This API token will affect the below accounts and zones, along with their respective permissions

- Workers KV Storage:Edit, Workers Scripts:Edit
- Zone:Read, DNS:Edit
All users - Memberships:Read, User Details:Read

When creating a custom token:
Account - Workers KV Storage - Edit
Account - Workers Scripts - Edit
User - Memberships - Read
User - User Details - Read
Zone - Zone - Read
Zone - DNS - Edit

Need to get Account ID from the Domain page under API.

Sharing this so that others can deploy successfully as well.

Thank you!

[Francis-Gurr]

I created my API token with these permissions, but I still get Project had an error after following the steps, and when I visit the worker: <worker-name>.<worker-subdomain>.workers.dev. I get API token missing.. Any ideas what I am doing wrong?

[Francis-Gurr]

Realised just visiting the worker probably doesn't auth with my api token. Tried checking with curl:

curl -X PATCH "https://unifi-cloudflare-ddns.worker.subdomain.workers.dev/update?ip=PUBLIC_IP&hostname=SUBDOMAIN.example.com" \
-H "Authorization: Bearer API_TOKEN"

But I get: Internal Server Error. I also have no logs for my worker in cloudflare.

[willswire]

Hey Francis! Please try the latest version of this project which has improved logging. Let me know if you can get responses from your worker.

[dontbeasquare]

Could you elaborate what the hostname should be while entering the ddns information in the unifi controller? Is it the domain name from Cloudflare? I am getting this error in my worker log.

"Error updating DNS record: The "hostname" parameter is required and cannot be empty."

[dcwtx]

you enter it in the Unifi dialog, and be sure the parameter at the end of the url is there: update?ip=%i&hostname=%h

[dcwtx]

This was very helpful for creating the worker. It might have been obvious to others but it wasn't to me. You can't use this API Token as the password in the Unifi dialog, you have to create a different one that only permits the dns zone edit. I have multiple zones in my profile, and when I used the token that I created the worker with, it failed saying it couldn't figure out the right zone. So create a new token, that only has the dns zone edit permission, and use that for the password and it will work.

[cwm12345]

@Francis-Gurr did you ever resolve the "Internal Server Error" issue? I'm encountering the same thing with a fresh install of the latest and greatest.

If I run curl -v I see a more detailed error from cloudflare:

"Error updating DNS record: InvalidCharacterError: atob() called with invalid base64-encoded data. (Only whitespace, '+', '/', alphanumeric ASCII, and up to two terminal '=' signs when the input data length is divisible by 4 are allowed.)"