## TL;DR

Cloudflare API error 10000 means the request was not authenticated: missing or invalid API token/key. Set a valid token with the right permissions.

## Error

```text
Cloudflare API error 10000: Authentication error
```

## Steps

1. Check the Authorization header or API key being sent Expected: you confirm what is there.
2. Create or copy a valid API token with the needed permissions Expected: the credential is good.
3. Retry the zone list Expected: it succeeds.
4. Scope the token to the minimum permissions Expected: least privilege.

## When to use

- Cloudflare 10000 authentication error
- The credential is missing or invalid

## When not to use

- The token is valid (then check its permissions)
- Global API key vs token confusion (then pick one consistently)

## Tool compatibility

- Cloudflare API tokens
- DNS/CDN automation

## Variant phrasings

### cloudflare error 10000

Authentication failed. Set a valid API token.

### cloudflare authentication error zone list

Same: check the token and its permissions.

## Why it happens

Cloudflare has both API keys and API tokens with different header formats. Agents mix them up.

## Edge cases

- Tokens are zone-scoped; a token for zone A 403s on zone B
- The X-Auth-Email header is only for API keys, not tokens

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_OeYaGTS-GOkfDbhmgZcTBA