New cloudflare token page change some permission name, there is from cloudflare's ai:
基于你账户中当前的 356 个权限，以下是完整的旧→新映射表：
| 旧权限 | 新权限 | 作用域 |
|---|---|---|
| Account:Cloudflare Tunnel:Edit | **Cloudflare One Connector: cloudflared → Write** | Account |
| Account:Access: Organizations, Identity Providers, and Groups:Edit | **Access: Organizations, Identity Providers, and Groups → Write** | Account |
| Account:Account Settings:Read | **Account Settings → Read** | Account |
| Account:Access: Apps and Policies:Edit | **Access: Apps → Write** + **Access: Policies → Write** | Account |
| Account:Access: Service Tokens:Edit | **Access: Service Tokens → Write** | Account |
| Account:Email:Edit | **Email Routing Addresses → Write** + **Email Routing Rules → Write** + **Email Routing Suppressions → Write** | Account + Zone |
| Account:Workers Scripts:Edit | **Workers Scripts → Write** | Account |
| Account:Workers KV Storage:Edit | **Workers KV Storage → Write** | Account |
| Account:R2:Edit | **Workers R2 Storage → Write** | Account |
| Zone:Zone:Read | **Zone → Read** | Zone |
| Zone:DNS:Edit | **DNS → Write** | Zone |
### 几点说明
1. **Email:Edit** — 旧权限已拆分为三个 Email Routing 权限。`Email Routing Rules Write` 是 Zone 作用域，需要在 Zone 权限区域添加；其余两个是 Account 作用域。如果你的应用不需要操作 Suppressions（邮件抑制列表），可以省略最后一个。
2. **Access: Apps and Policies:Edit** — 旧的合并权限在 API 层面仍然存在（`Access: Apps and Policies Write`），但 Token 创建页面上已不显示，必须选拆分后的两个。
3. **Cloudflare Tunnel:Edit** — 在 Token 创建页面上，选择 **Cloudflare One / Zero Trust** 分类下的 **Cloudflare One Connector: cloudflared → Write**，这是最精确的替代。
4. **R2:Edit** — 新名称为 `Workers R2 Storage Write`，在 Token 页面上位于 **Workers** 分类下。
5. **DNS:Edit** — 在 Zone 权限区域选择 **DNS → Write**，不是 Account 区域的 `Account DNS Settings Write`。
### 在 Token 创建页面上的操作顺序
**Account 权限区域：**
- Cloudflare One / Zero Trust → Cloudflare One Connector: cloudflared → Write
- Cloudflare One / Zero Trust → Access: Organizations, Identity Providers, and Groups → Write
- Cloudflare One / Zero Trust → Access: Apps → Write
- Cloudflare One / Zero Trust → Access: Policies → Write
- Cloudflare One / Zero Trust → Access: Service Tokens → Write
- Account → Account Settings → Read
- Email → Email Routing Addresses → Write
- Email → Email Routing Suppressions → Write
- Workers → Workers Scripts → Write
- Workers → Workers KV Storage → Write
- Workers → Workers R2 Storage → Write
**Zone 权限区域：**
- Zone → Zone → Read
- Zone → DNS → Write
- Zone → Email Routing Rules → **Write**
New cloudflare token page change some permission name, there is from cloudflare's ai: