What each permission on Cloudflare's consent screen is used for:
offline_accessKeeps you signed in without repeating Cloudflare's sign-in.
teams.writeManages this app's Gateway DNS/HTTP policies and blocklists on the account you authorized, and reads its DNS locations and content categories.
memberships.readFinds the account ID you authorized, since Cloudflare doesn't provide it. Other accounts aren't shown.
user-details.readOptionalReads your name and email to show who's signed in.
Revoke access anytime in Cloudflare: My Profile → Access Management → Connected Applications
This site is not affiliated with, sponsored by, or endorsed by Cloudflare, Inc.