Cloudflare BYOIP: your own IP prefixes on Cloudflare's network

A documented API flow checks the prefix against the IRR, RPKI and an ownership token, and you then bind it to the services that will use its addresses.

What Cloudflare accepts

From Cloudflare's documentation, on the day we checked:

• Who. Enterprise accounts whose contract includes BYOIP. The account team confirms this, and the account's service configuration, before you onboard.
• Size. A /24 or larger for IPv4.
• Registry. ARIN, the RIPE NCC, APNIC or one of the other regional registries. Nothing on PA, PI or legacy space.
• Who originates. AS13335 in the documented flow; for your own ASN, ask the account team. Customers already on Cloudflare's AS209242 may keep it, but new onboardings use AS13335.
• Where. All Cloudflare locations.
• Services. Magic Transit, Spectrum, the CDN, and Gateway DNS locations and dedicated egress IPs. Magic Transit has its own onboarding, is "not a self-serve product", and can only be the default binding of a whole prefix. A prefix serves CDN ingress or CDN egress, not both.
• Price. Not published. The terms say the addresses must be used "solely in connection with the Customer's domains that are receiving Cloudflare's Enterprise Services".
• Timing. At least five hours of BGP provisioning before you advertise, and four to six hours for each service binding to propagate. Magic Transit's configuration "takes around one day to roll out".

Before you start

Cloudflare cannot onboard a prefix if any registration, IRR, RPKI or ownership check fails. Prepare these:

A route object that matches exactly. One route object per prefix you onboard, for exactly that prefix, with the origin Cloudflare will use: AS13335 in the standard flow. To check it, Cloudflare suggests IRR Explorer or whois -h rr.ntt.net 203.0.113.0/24.

A correct ROA for the same origin. Cloudflare asks you to verify it in its RPKI Portal and in a second source, such as Routinator (RPKI and ROAs).

A letter of agency (LOA), Cloudflare's name for the letter of authorization, which its transit providers require. Cloudflare generates it for you when you set delegate_loa_creation to true, which relies on the ROA and the ownership check. A manual LOA must be a PDF, and should be on company letterhead with a wet signature, though Cloudflare accepts a digital signature if it is clear who signed. Transit providers may reject a JPG or PNG, and manual processing can slow onboarding.

A place for the validation token: the description (descr) or remarks of the matching route object, or a cf-validation TXT record in each reverse DNS zone of the prefix.

An account ID and an API token with the IP Prefixes permissions.

Step by step

This is Cloudflare's documented flow for prefixes not used with Magic Transit, which has its own onboarding through the account team.

01Add the prefix to the account that will own it:

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/addressing/prefixes" \
  --request POST --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{"cidr":"203.0.113.0/24","asn":13335,"delegate_loa_creation":true}'

Save the id and the ownership_validation_token from the response.

02Publish the token. Add cf-validation: <token> to the route object, or the TXT record to the reverse zones.

03Validate. Send a POST to .../prefixes/$PREFIX_ID/validate. When the IRR, RPKI and ownership checks pass, the prefix's approved field reads "V", and you can remove the token. If a check fails, the prefix details show states such as missing, invalid or mismatch_asn.

04Bind the prefix to a service. Every prefix needs a default service binding over the whole prefix; more specific bindings can send parts of it to the CDN or Spectrum. Cloudflare creates the BGP prefix in a withdrawn state. Allow at least five hours, and wait until every binding is active.

05Advertise:

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/addressing/prefixes/$PREFIX_ID/bgp/prefixes/$BGP_PREFIX_ID" \
  --request PATCH --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{"on_demand":{"advertised":true}}'

Cloudflare says advertising typically takes two to seven minutes, and withdrawing about 15.

06For the CDN, create an address map once the prefix is advertised, so proxied DNS records answer with your addresses.

Pitfalls

• A covering route object is not enough. Cloudflare wants a route object that exactly matches each prefix you onboard, with the right origin.
• Bindings take hours, and traffic suffers meanwhile. Cloudflare says services for the addresses concerned are likely disrupted while a binding propagates. Set bindings up before you advertise, and change them outside busy hours.
• Two networks announcing. When you move a live prefix, let Cloudflare advertise first, check it on a looking glass under AS13335, then withdraw your own announcement. Leave yours up and some traffic may bypass Cloudflare.
• The 15-minute rule. After changing a prefix's advertisement, wait at least 15 minutes before changing it again; the API refuses earlier calls with error 1004.

If you lease the block

Cloudflare's service-specific terms, last updated 28 September 2026, cover this directly. If you are not the legal owner of the addresses, you "must obtain written authorization from the legal owner" for Cloudflare to announce them, and if the owner withdraws it, Cloudflare may stop advertising them. The holder also does the registry side: the ROA for AS13335, the route object with AS13335 as origin, and the validation token in that object, which only the holder's maintainer can edit. The terms ask for accurate WHOIS data and valid IRR and RPKI entries at all times, so a lease that ends or a ROA that changes can take the prefix off Cloudflare.

Where RTM Networks fits

We lease /24s and larger from our own RIPE NCC address space, and sell blocks in the RIPE NCC, ARIN and APNIC regions. For space leased from us, we create the ROA and the exact route object for AS13335, add Cloudflare's validation token to it and sign the letter of authorization, so the API steps are what is left to you (lease IPv4). If BYOIP is not in your Cloudflare contract, or you need fewer than 256 addresses, we announce a block and deliver it to your server over GRE or WireGuard, down to a single address (GRE and WireGuard tunnels). Other providers: BYOIP guides.