Agents can now create Cloudflare accounts, buy domains, and deploy

(blog.cloudflare.com)

197 points | by rolph 4 hours ago ago

106 comments

  • _pdp_ an hour ago

    The reason this blog post does not come with any concrete examples how to use this enablement for useful and constructive things tells you something very important - it is a toy and they do not know who and how they will use it.

    It is cool feature but to what end? Buying a domain is not something you have to do daily to require any kind of automation.

    I am also not sure who Stripe Atlas for. I am genuinely confused. It is definitely not something a developer will use.

    I understand that you can bootstrap a number of systems but that is like half-hour of work and arguably it is probably a good idea to do it manually to make sure you have strong foundations.

    I've have personally never seen a good example where a cross vendor account provisioning actually working. For example, Fly.io used to provision Sentry accounts automatically which you could not access in any other way but through Fly.io. I mean the Sentry account was effectively locked to a project that you cannot transfer - hijacking the actual global alias as well. Vercel did something similar with PostgreSQL via Neon and Redis via Upstash resulting in painful migration processes.

    I can imagine ending in some kind of deadlock between services due to security hence why the 30 minutes initial setup is kind of time well spent to avoid future issues.

    Maybe it's me.

    • grey-area an hour ago

      Perfect for spammers, scammers and domain squatters, who can now automate their activities even more.

      Can’t think of any other uses for this given the current state of LLM ‘agents’, though I can’t wait for the next report of something like ‘openclaw registered 1000 domains for me without asking and now cloudflare won’t refund me’.

      • riedel an hour ago

        And cloudflare can actually sell them priority access to pass their bot protection or introduce micropaiments for agents access content. I feel cloudflare is getting a bit scary tbh. It is like your friendly bot net.

    • ascorbic 13 minutes ago

      People use agents to deploy sites all the time. Buying a domain is part of that if you want to build a site that's beyond a toy. Allowing agents to do a task isn't just for things you do every day – it's also for things you do rarely and need agents' help. It's not just devs using agents to perform these sort of tasks anymore.

      Stripe Atlas makes it massively easier for startups to incorporate in Delaware. This is particularly hard for non-US founders. It solves a real problem. I don't think this part will be done by agents though!

      Disclaimer: I work at Cloudflare but not on this

      • makeitdouble 5 minutes ago

        Wouldn't it be critical if the agent botched the domain purchase in weird ways ?

        Short of throwaway sites (spam etc) it's hard to imagine skimping time on this specific, mostly painless part.

    • compounding_it an hour ago

      > to what end?

      People making cooking websites, websites for their garden, etc usually have nowhere to go. A web app who is an agent for a customer will then deploy agents in the backend to deploy the website too.

      Basically what one would do manually, you tell one agent to make another agent do it.

      Meta agents are where are going it seems.

      • tdeck 15 minutes ago

        > People making cooking websites, websites for their garden, etc usually have nowhere to go.

        They've had WYSIWYG website builders since the late 1990s.

    • hulitu 20 minutes ago

      > it is a toy and they do not know who and how they will use it.

      Just like it is usually used: spam and (D)DoS

    • cromka an hour ago

      > Buying a domain is not something you have to do daily to require any kind of automation.

      Sorry, but no, you totally miss the fact there are domain farms which buy the dropped domains and then offer them up for sale. Bots now use AI to analyze the domain's value and automate the whole process. To be able to let AI buy it as well likely offers a tremendous amount of time saving.

      • przmk an hour ago

        It offers value to parasites who buy domains and resell them?

        • estimator7292 an hour ago

          Cloudflare gets a cut though, so it's valuable. As long as number go up, all good

          • adventured 3 minutes ago

            Cloudflare operates as an at-cost registrar. They charge wholesale prices for domains.

            What cut are you talking about?

      • Griffinsauce an hour ago

        So actively making the internet worse. Awesome.

      • dawnerd 18 minutes ago

        And that goes back way further than AI. We were doing some crazy stuff at Demand Media with enom and all their fake content sites.

      • misnome an hour ago

        Hasn’t all that been automated by people for decades anyway?

        I guess this, lowers the barrier to entry for this extremely specific niche?

      • 2000UltraDeluxe an hour ago

        It's not like there aren't others who sell domains with an API. This doesn't change that much.

      • fontain an hour ago

        Complete and utter nonsense.

        Domain registration is already API driven and has been for decades. The most sophisticated domain name investors (or "domain farms") go as far as to own registrars directly so they have instant access to the registries. Nobody involved in domains would use Cloudflare's product because they already have and have had automations for decades.

        For example, DropCatch (NameBright) own over 1,000 different registrars so that they have over 1,000 direct routes to Verisign's .com registry. GName are a new player in the space, approaching 1,000 registrars. The amount these companies spend on their registrar licensing alone is many millions of dollars[1].

        Cloudflare's product adds nothing new to the world of domains. Anyone has been able to go to OpenSRS and sign up as a reseller with API access for over 20 years.

        [1] The majority of ICANN's registrar revenue comes from just a few companies that own thousands of registrars collectively: https://www.iana.org/assignments/registrar-ids/registrar-ids... cmd + f "DropCatch" and "GName"

    • terrytys 42 minutes ago

      lol, there are lots of people who aren't developers.

  • jackconsidine 3 hours ago

    That is ironic. Four years ago, cloudflare didn’t let human me have an account / buy domains because I signed up, never used a single service but didn’t respond to a request to verify my drivers license

    > This account is in violation of Cloudflare's Terms of Service. Specifically fraud. The suspension is permanent.

    (Yes that’s really it. Sincerely. No “but I also abused X”)

    • nojs 2 hours ago

      This conflict is popping up everywhere. There is a push by a lot of companies to allow agentic use of their services (and new companies explicitly offering "X for agents"), ignoring the fact that "agent" means the same thing as "bot" which we've spent the last couple of decades actively filtering out. Will be interesting to see how it plays out.

      • janalsncm 2 hours ago

        In defense of old-school bots, we had to code them up by hand.

      • Gigachad an hour ago

        The future is the internet will be entirely bot activity and humans will ether be strapped in to the metaverse reels ai slop feed or they will be outside interacting with people in person again. Both of these seem like likely futures and probably both at the same time.

        • ethagnawl 17 minutes ago

          This reality also crystalized for me earlier this week when I saw a post about unchecked AI slop videos about WWE being posted to YouTube. Many of the videos suffer from the LLM stroking out (for lack of a better term) and devolving into mumbling, screaming and white noise. Yet, the comments are replete with obvious bot content which doesn't mention this at all and talks past the larger, flimsy narrative on display (i.e. AI-generated), anyways. We're exhausting our natural resources and reducing quality of life for a great number of real, live people so bots can talk past each other on YouTube.

          So, if you're looking for me, I'll be hiking while it's still legal.

        • e40 an hour ago

          So pne step towards the Neuromancer universe.

    • captn3m0 3 hours ago

      > By agreeing to these Terms, you represent and warrant to us: (i) that you have not previously been suspended or removed from the Websites and Online Services

      CloudFlare ToS has you covered. A human must accept it, even with the new agentic flow.

      • jasomill an hour ago

        I think this is just saying you can’t sign up for a new account after a previously created account gets suspended, not that the act of suspension itself causes you to violate the the terms of service in perpetuity because, pedantically, any suspension that has happened, happened “previously”.

  • firefoxd 2 hours ago

    The agent starts a phone call, listens to the person on the line, analyzes which fraud bucket they fall into, and start the process.

    While they are on the phone with the agent, it buys a domain relevant to the victim, the agent codes and deploy the website specially catered to them and the fraud bucket. Collect payment, destroy the website, redirect the domain to google.com. no need to start a new call because you had several agents committing the same fraud in parallel.

    It can also be used to make art.

    • Mario9382 6 minutes ago

      I thought this was excessive and impossible, but as I was reading, I realized nowadays everything you say is technically possible. The future gives me the chills.

    • iugtmkbdfil834 21 minutes ago

      Some would argue, forcefully at that, that AI cannot make art and/or cannot be used to make art.

      What I saw was Transmetropolitan setup, where Hole renews their presence online every 5 minutes or so to avoid government censor.

      • lxgr 6 minutes ago

        People used to say the same about photography a while ago.

        • iugtmkbdfil834 4 minutes ago

          Oh:D I am not saying they are right, but the sentiment has become rather strong lately.

  • sshine 9 minutes ago

    I recently started migrating my DNS to a DNSSEC-enabled provider.

    This involves copy-pasting DNSSEC properties from one web interface into another.

    Pretty much everything but this step has been automated in my website creation process: Picking a git template for my site, creating the git repository remotely on my self-hosted Forgejo, setting up the webserver and the DNS using external-dns. Only the domain creation and initial pointing of NS and DNSSEC records is something I sit and do.

    I'm not willing to switch to Cloudflare for this feature.

    But it reminds me there's more to automate.

  • faangguyindia 2 hours ago

    One of the well-kept secrets about Cloudflare is:

    You can have a zero-cost inbox.

    Earlier, I was using Zoho and FastMail (however you dice it, it will use some money, $12 a year for Zoho and $7 per month for FastMail? Even then, perhaps you only get one mailbox and some aliases)

    but with this method, I get unlimited aliases, domains, and mailboxes:

    Now, I wrote a script which captures the email and saves attachments to S3 using the HTTP API (why S3 and not R2? Because Cloudflare wanted a credit card, and I was too lazy to add it there lol) and emails to D1.

    This uses an email -> webworker workflow.

    I use an API to fetch my emails.

    This means all my inbound emails are now handled by Cloudflare, and I can easily use all of it with zero payment.

    The best part is this supports tokenised emails, so I can provide a unique email address to each service I sign up for.

    I am using SES as the sender. I’ve set up one script which auto-sets up any domain in SES and auto-verifies the sender email.

    The funniest thing is I am receiving zero spam? As if other email providers sell my email?

    • sim04ful a minute ago

      On a related note they opensourced an email client: https://github.com/cloudflare/agentic-inbox

    • dewey an hour ago

      That's not a well kept secret, that's just a workflow that almost nobody would accept for their email setup which is the center of most people's digital identify and should always work and not be a duct taped construct to save a couple of bucks.

      • faangguyindia 44 minutes ago

        isn't cloudflare webworker and email forwarding infra hyperscaling and highly available?

        • dewey 26 minutes ago

          It's not about the uptime or scalability. Everyone has to make the choice for themselves if they value their time less than $12/year (Or free if Google is an option) for a critical part of their digital infrastructure to set all these moving parts up and keep them running over years.

          I'll stick to Fastmail, where if something isn't working as expected I can just email them and get a response from a real human.

        • selcuka 37 minutes ago

          It doesn't change the fact that the workflow gp explains is a duct taped construct.

          It's hyperscalable and highly available today, until the API changes.

        • weird-eye-issue 37 minutes ago

          Yeah it's highly available until it isn't and then that turns into your problem rather than something like Gmail just working

          • faangguyindia 28 minutes ago

            that's the thing it cannot stop working because webworker and email forwarding is very reliable, email itself has retries built it and soft bounce handling.

    • twostorytower 3 minutes ago

      There’s a completely free tier of Zohomail which does more than what I need for a custom email.

    • twothumbsup 2 hours ago

      cf bought an email security company a couple years ago so wouldn’t shock me they have good spam filtering.

    • fragmede an hour ago

      That's pretty neat! What do you use to send and receive emails on your phone?

      • faangguyindia 43 minutes ago

        once you've emails stored, you can use any webclient.

        you can write an api to imap adapter and use it in your favourite mail client

        SES exposes SMPT directly.

  • c-linkage 3 hours ago

    [flagged]

    • loganc2342 3 hours ago

      Reminds me of an article from The Onion from this morning: https://theonion.com/taking-advantage-of-other-people-was-th...

    • throwup238 3 hours ago

      Have you talked to Andreesen Horowitz yet? That elevator pitch alone should get you a few million.

      • silcoon 3 hours ago

        Curious, is there an Andreesen Horowitz Agent MCP?

        Let’s automate this end to end, from idea to raising capitals. Vibe Angels should just be multi agents managing how much capitals to allocate to each projects.

        • zbentley 2 hours ago

          You joke, but like the meme goes: go knocking on enough doors asking to see the devil, and eventually he might answer.

  • dirkc 14 minutes ago

    A few months back I was building a product and wanted to add domains. My first choice would have been to use Cloudflare as the registrar, but they didn't support buying domains via the API.

    I wonder if this means I can now also buy a domain via the API?

  • dgan an hour ago

    Industry really went from "prove you are not a robot", to "but also if you are, this way please"

    • hansvm 28 minutes ago

      About goddamn time. The recent past consisted of discord blocking me because their telemetry was broken and exceeded their rate limit and target blocking me because two devices in a single household look really suspicious.

    • skybrian 25 minutes ago

      I mean, Cloudflare will help website owners ban scrapers unless they pay. It’s kind of what they do.

  • hboon 2 hours ago

    I was pleasantly surprised when I read the headline a few days ago. But it's only accessible through Stripe right? I'm simultanenously very concerned about the centralized control that Stripe gains (it's not going to be just access to Cloudflare) and also amazed at how Stripe is shaping to be. It was just a payment processor.

  • aleksiy123 2 hours ago

    I was wondering if someone was going to allow payments through CLI at some point.

    But jokes aside having a central place to manage billing and accounts for deploying infra across multiple providers is pretty awesome imo.

    if they have a terraform provider even better. I wonder if also makes multi tenant architectures or environment isolation easier to provision as well.

    • skeptic_ai 2 hours ago

      Wait until one account is banned, and then all linked accounts are permanently banned.

  • schpet 2 hours ago

    why does cloudflare not allow existing users to create new accounts? you basically need to use a burner email and transfer it afterward. makes it awkward to use this on new projects that you want independent of your existing accounts.

  • faangguyindia 2 hours ago

    Most of the sysadmin and devops team have been downsized in India because of AI.

    Basically, now it's trivial for any new devops guy to run such a query in Claude Code:

    “Log in to this production server, find out all services it runs and their deployment method, create documentation about everything, and generate a repeatable, auditable deployment workflow.”

    Devops and sysadmins can no longer withhold information to maintain job security.

    Boom, 80% of the team gone.

    I know companies are doing migrations of production Postgres and MySQL on 1000s of machines using AI agents.

    I’m imagining how many SaaS will be automated out and simply be an "agent skill" in ClaudeCode.

    • otterley an hour ago

      Can you support this claim with some evidence? Not just about the redundancies, but I’m also particularly interested in hard data showing Claude is capable of doing that kind of research with near 100% verifiable accuracy and migrations with no data loss and equivalent functionality (which is required to sustain your claim).

      • faangguyindia an hour ago

        is most sysadmins and devops capable of 100% verifiable accuracy? you over estimate average skill level available in market.

    • zbentley 2 hours ago

      > Devops and sysadmins can no longer withhold information to maintain job security.

      I can't imagine this is very prevalent. That's a very 2004-style corporate immaturity; I get the sense that even the slow-moving behemoths of the software world have mostly caught up to, say ... 2017's recognition of the importance of automation and reproducibility and won't tolerate the kind of malpractice you describe--wilful information siloing by infrastructure teams.

      Like, those businesses might well suck at automation! But they've been doing it and firing the people who resist it for a long while now.

    • vatsachak an hour ago

      Epic. Can't wait for those humans to be rehired after you find out that letting Claude perform 1000s of migrations autonomously is a bad idea

    • bakugo 2 hours ago

      Only downsized? I would expect them to cease to exist entirely in the coming years, as western companies begin to realize that AI is cheaper and more competent than the Indian firms they usually outsource work to.

  • jakebasile 3 hours ago

    As a user of the internet I can only imagine this worsening my experience by allowing even more slop to permeate the network's every orifice.

    Also, when an agent sets up a domain, who is the domain owner? Who responds to takedown requests? What if it then decides to host illegal content at the domain (generated or otherwise). Who is responsible? Agents aren't (yet) legal persons, so it must be the person who owns the agent, but if that person never even sees the legal agreement being agreed to how would it hold up in court? If the person didn't direct the creation or hosting of illegal content, what then?

    • idank 2 hours ago

      Humans will not win in court with a "but the agent did it, I had no idea" argument. Just look at how the cases against OAI are going, and that's where families lose a loved one. There's not going to be any sympathy when your agent committed fraud on your behalf.

      And it's not like pro agent companies have a reason to self regulate. They're not going to absorb that liability voluntarily, they'll push it onto users contractually (most of them already do). This is just another channel to bring in customers. They will capitalize ruthlessly to increase their bottom line.

      • zelon88 2 hours ago

        > There's not going to be any sympathy when your agent committed fraud in your behalf.

        Good thing the fraud is committed in places that specifically don't prosecute fraud when it's targeted against Western countries.

      • skeptic_ai 2 hours ago

        Fraud requires intention

    • 14 2 hours ago

      Interesting questions you bring up. Especially the legal ramifications as to how it would fully work within current legal framework. I suppose there would be a broad disclaimer and agreement one would have to agree to that would state that users of the service are ultimately responsible to monitor and ensure websites deployed by agents comply with local laws. Ultimately I assume that since it is not the agent who pays but a registered user that the user would own the site. And that the legal agreement would be agreed to beforehand so it is legally binding.

  • readitalready 2 hours ago

    This probably started because of Andrej Karpathy's complaint about deployment being more painful than coding itself.

    • trick-or-treat a minute ago

      Yes I'm sure that whenever Andrej Karpathy complains, the market reacts. By the way, remind me who Andrej Karpathy is?

  • saneshark 3 hours ago

    Claude has been buying domains and deploying to Vercel for me using aws cli, vercel cli, and gh cli since December. Personally I prefer a cli to an MCP server for this type of thing.

    • Waterluvian 3 hours ago

      Are any of these domains public? I’d love to study and better understand the use case for needing to AIify this.

      • saneshark an hour ago

        All of the domains are public. Whenever a new model comes out I like to ask a very specific prompt that helps me identify niche markets with high buyer urgency, have the AI rank them across a rubric, pick the one that has the highest degree of automation potential and then have it build me an MVP.

        I’m not trying to shamelessly promote here but since you asked one of them is at jobwiz.biz

        • hhh a few seconds ago

          coming soon q2 2025?

        • fragmede an hour ago

          Your SSL cert needs to be rotated.

      • threethirtytwo 2 hours ago

        It’s not AIifying one thing. It’s AIifying the entire work flow… every detail. Allowing domain names is just one aspect of it.

        The agent does everything. “Make a website that does…“ and it can handle everything from start to finish. It’s that good now.

        • SpicyLemonZest 2 hours ago

          The question was what's in the dots. I have no doubt that agentic systems are good enough to buy domains and make one-shot websites from a prompt, but what is the legitimate use case for which you'd want to repeatedly perform "Make a website that does..." on a new domain?

          • fragmede an hour ago

            "Legitimate"? What scams are you implying are happening? A friend of mine wanted a site to help him sell DJ lessons. Another friend has a haircutting business that wanted a better site. Massage therapy. Etc.

  • dr_dshiv an hour ago

    These days, website or service “usability” means that Claude code can do it for you.

  • debarshri an hour ago

    Ps. Agents can also sell and delete domains.

  • shevy-java 13 minutes ago

    Skynet - and so it begins ...

  • eptityri 31 minutes ago

    I literally hate it every time I try to visit a website and face Cloudflare bot verification. And now, they’re letting bots create accounts and buy domains. Double-standard hypocrisy.

    • ascorbic 5 minutes ago

      It's not as simple as being pro- or anti-bot. It's about giving site owners the tools to decide whether or not they want to allow them. Seems pretty consistent to me. If they don't want bots, they can use tools to identify and block them. If they do, they can do things like automatically deliver markdown versions to them, or use x402 to charge micropayments.

      Disclaimer: I work at Cloudflare, but not on these

  • arjie 3 hours ago

    Fascinating. This is through Stripe rather than wrangler or anything. Coding agents were pretty good at handling the Cloudflare API already with an API key, but I think this thing that Stripe is doing by being the central hub through which all agent stuff goes by integrating with their CLI is a pretty good move for them.

    • joemazerino 3 hours ago

      Buying the domain is the key here.

  • zelon88 2 hours ago

    And CloudFlare engineers sleep comfily at night knowing that they just produced 800 lbs of carbon emissions to generate a static "Hello World" HTML page.

    I see the amount of work that gets put into these workflows and it boggles my mind that anyone thinks that it's faster or easier or more convinient or more cost efffective than installing a LAMP stack on one of the 6 laptops they have stuffed in a closet. God forbid anyone have any native local capability.

    • unglaublich 2 hours ago

      But they paid for the emission just like every other electricity consumer? Then who are we to determine the Hello World page is morally more wasteful than outdoor terrace heaters or advertising jumbo-trons?

      • zelon88 2 hours ago

        I hear your argument. However, you assume CloudFlare pays taxes and utility rates comparable to what other customers pay. That is never the case with large businesses. CloudFlare seems to be less parasitic than others in the industry, but they are not doing this for the charity.

        For example, in 2024 JPMorgan received a $77m subsidy to build a datacenter that created only one permanent job.

        https://nysfocus.com/2026/04/20/data-center-tax-break-jpmorg...

        • charcircuit an hour ago

          Why should that matter? If a counterparty gives them a deal they should take it.

  • baalimago an hour ago

    Genius! Automate the flow for making customers spend money.

  • stevefan1999 2 hours ago

    Can I make a bot to buy the domain at the best price, transfer that domain to Cloudflare instead?

    • caymanjim an hour ago

      Cloudflare's prices are already close to unbeatable. They basically resell at cost. But there's nothing stopping you from doing that if you want.

      • forsalebypwner 34 minutes ago

        Cloudflare's prices are very beatable, especially if we're talking about the first year price.

        Their name doesn't appear in the first 6 pages (~175 TLDs) of this list https://tldes.com/cheapest-domains

        On renewals they appear much more competitive though.

  • floodfx 3 hours ago

    I clicked through the $100k credits link and didn’t see Cloudflare listed as an Atlas partner? (Maybe not updated?)

    This looks interesting nonetheless.

  • yanis_t an hour ago

    I mean couldn’t they already do that? Isn’t it the whole per pose of agents to do whatever any person can do on a machine?

    • ascorbic 3 minutes ago

      Not via the API, previously.

  • sovenyr 2 hours ago

    don't even supricezed - I've done it before even without agents

  • swader999 2 hours ago

    Who goes to websites these days?

  • rvz 2 hours ago

    > At the end, the agent has deployed to production, and the app runs on the newly registered domain:

    Soft scammers, fraudsters and defamers are celebrating in copying websites for malicious intent.

    For sure this is going to get abused.

  • charcircuit an hour ago

    So does this mean banned sites can now come back as long as they have an agent make an account instead of the banned user.

  • slopinthebag 2 hours ago

    Thank god, this is what we've been missing on our quest to make software better for our users.

  • Phelinofist 2 hours ago

    Soooo they built.... an API?

  • DeathArrow 2 hours ago

    So they made it possible for agents to spend people's money buying their services.

    Why didn't Amazon think of that?

  • hedayet 2 hours ago

    Nice. Another step closer to the "dream" of filling the web with trash at scale

  • armanj 3 hours ago

    > buy

    good luck