From 043f1ef1382d75f45804948abb6f489b0d5b4168 Mon Sep 17 00:00:00 2001
From: Prowler Bot <bot@prowler.com>
Date: Thu, 16 Apr 2026 13:25:09 +0200
Subject: [PATCH] fix(sdk): allow account-scoped tokens in Cloudflare
 connection test (#10731)

Co-authored-by: Andoni Alonso <14891798+andoniaf@users.noreply.github.com>
---
 prowler/CHANGELOG.md                                |  8 ++++++++
 prowler/providers/cloudflare/cloudflare_provider.py | 11 ++++-------
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 9a7d509009..991ac60a0b 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -2,6 +2,14 @@
 
 All notable changes to the **Prowler SDK** are documented in this file.
 
+## [5.24.1] (Prowler UNRELEASED)
+
+### 🐞 Fixed
+
+- Cloudflare account-scoped API tokens failing connection test in the App with `CloudflareUserTokenRequiredError` [(#10723)](https://github.com/prowler-cloud/prowler/pull/10723)
+
+---
+
 ## [5.24.0] (Prowler v5.24.0)
 
 ### 🚀 Added
diff --git a/prowler/providers/cloudflare/cloudflare_provider.py b/prowler/providers/cloudflare/cloudflare_provider.py
index 35dd88ef76..35067c30d8 100644
--- a/prowler/providers/cloudflare/cloudflare_provider.py
+++ b/prowler/providers/cloudflare/cloudflare_provider.py
@@ -332,19 +332,16 @@ class CloudflareProvider(Provider):
             return
         except PermissionDeniedError as error:
             error_str = str(error)
-            # Check for user-level authentication required (code 9109)
-            if "9109" in error_str:
-                logger.error(f"CloudflareUserTokenRequiredError: {error}")
-                raise CloudflareUserTokenRequiredError(
-                    file=os.path.basename(__file__),
-                )
             # Check for invalid API key or email (code 9103) - comes as 403
             if "9103" in error_str or "Unknown X-Auth-Key" in error_str:
                 logger.error(f"CloudflareInvalidAPIKeyError: {error}")
                 raise CloudflareInvalidAPIKeyError(
                     file=os.path.basename(__file__),
                 )
-            # For other permission errors, try accounts.list() as fallback
+            # For permission errors (including 9109 account-scoped tokens),
+            # try accounts.list() as fallback before failing.
+            # Error 9109 means the token is account-scoped, not user-level,
+            # which is valid for scanning — only fail if accounts.list() also fails.
             logger.warning(
                 f"Unable to retrieve Cloudflare user info: {error}. "
                 "Trying accounts.list() as fallback."