API & CLI Automation Preflight

What this checklist is for

This page explains what we need before using command-line tools or APIs to automate Cloudflare DNS, Namecheap registrar checks, Google Workspace email verification, Shopify setup, and backend deployment.

The rule: automate read-only checks first, then carefully automate writes after records and rollback are verified.

Automation priority

Platform	Automate first?	Recommended first action
Cloudflare	Yes	Read-only API inventory of zone and DNS records.
Backend host	Yes	Automated deploy/env checks once hosting is chosen.
Google Workspace	Partial	Automate DNS verification; keep admin writes manual first.
Shopify	Partial	Manual page/domain setup first; CLI/API later for themes/app proxy.
Namecheap	Read-only first	Export current DNS/nameserver state before any cutover.

Secrets we may need

CLOUDFLARE_API_TOKEN=
CLOUDFLARE_ZONE_ID=
SHOPIFY_STORE_DOMAIN=
SHOPIFY_ADMIN_ACCESS_TOKEN=
SHOPIFY_APP_SECRET=
GOOGLE_WORKSPACE_ADMIN_EMAIL=
GOOGLE_WORKSPACE_CUSTOMER_ID=
NAMECHEAP_API_USER=
NAMECHEAP_API_KEY=
NAMECHEAP_USERNAME=
NAMECHEAP_CLIENT_IP=
BACKEND_HOST_API_TOKEN=
ADMIN_PASSWORD=
ADMIN_SESSION_SECRET=
CSRF_SECRET=

Safe first scripts to build

Script	Purpose	Risk
`scripts/check_dns.py`	Verify DNS records resolve as expected.	Low: read-only
`scripts/check_email_auth.py`	Verify MX, SPF, DKIM, DMARC DNS records.	Low: read-only
`scripts/check_cloudflare_zone.py`	Use Cloudflare API to inventory DNS records.	Low if token is read-only
`scripts/preflight_report.py`	Create a plain-English readiness report.	Low: read-only

Do not automate yet

Namecheap nameserver cutover
Deleting DNS records
Changing MX records
Changing SPF/DKIM/DMARC records
Switching Shopify App Proxy to production

Definition of ready

Cloudflare read-only API token exists.
Cloudflare zone ID for bentondrones.com is known.
Namecheap DNS and nameservers are screenshotted/exported.
Google Workspace MX/SPF/DKIM/DMARC records are confirmed.
Shopify A/CNAME requirements are confirmed.
Backend hosting provider is selected.
Production target for leads.bentondrones.com is known.
Secrets storage approach is chosen.

Domain Setup Roadmap