diff --git a/pkg/services/cloudflare_service.go b/pkg/services/cloudflare_service.go
index 7e0b11e..0b6e1d6 100644
--- a/pkg/services/cloudflare_service.go
+++ b/pkg/services/cloudflare_service.go
@@ -174,6 +174,23 @@ func (c *CloudflareClient) GetUser() (*CFUser, error) {
 	return &user, nil
 }
 
+// CFTokenVerify resultado de la verificación del token.
+type CFTokenVerify struct {
+	ID        string `json:"id"`
+	Status    string `json:"status"`
+	NotBefore string `json:"not_before"`
+	ExpiresOn string `json:"expires_on"`
+}
+
+// VerifyToken verifica la validez del API token usando /user/tokens/verify.
+func (c *CloudflareClient) VerifyToken() (*CFTokenVerify, error) {
+	var result CFTokenVerify
+	if err := c.get("/user/tokens/verify", &result); err != nil {
+		return nil, err
+	}
+	return &result, nil
+}
+
 // GetZones lista todas las zonas de la cuenta.
 func (c *CloudflareClient) GetZones() ([]CFZone, error) {
 	var zones []CFZone
diff --git a/resources/views/cloudflare.html b/resources/views/cloudflare.html
index 542a89c..118582c 100644
--- a/resources/views/cloudflare.html
+++ b/resources/views/cloudflare.html
@@ -233,6 +233,10 @@
                 </div>
                 <div class="flex justify-end gap-3 pt-2 border-t">
                     <button type="button" @click="configModal=false" class="px-4 py-2 border rounded text-sm">Cancelar</button>
+                    <button type="button" @click="verifyToken()" :disabled="loading"
+                        class="px-4 py-2 border border-orange-400 text-orange-600 rounded text-sm hover:bg-orange-50">
+                        Verificar token
+                    </button>
                     <button type="submit" :disabled="loading" class="px-5 py-2 text-white text-sm rounded"
                         style="background-color:#8eb02f">
                         <span x-text="loading ? 'Guardando…' : 'Guardar'"></span>
@@ -328,6 +332,18 @@ document.addEventListener('alpine:init', () => {
             this.loading = false;
         },
 
+        async verifyToken() {
+            this.loading = true;
+            try {
+                const res = await axios.get('/app/cloudflare/verify');
+                const status = res.data?.data?.status || 'active';
+                this.showToast('Token válido — estado: ' + status);
+            } catch (e) {
+                this.showToast(e.response?.data?.error || 'Token inválido o sin permisos', 'error');
+            }
+            this.loading = false;
+        },
+
         showToast(msg, type = 'ok') {
             this.toast = { show: true, msg, type };
             setTimeout(() => this.toast.show = false, 3500);
diff --git a/rest/controllers/cloudflare_controller.go b/rest/controllers/cloudflare_controller.go
index 6c84b25..fcdc5d2 100644
--- a/rest/controllers/cloudflare_controller.go
+++ b/rest/controllers/cloudflare_controller.go
@@ -1,6 +1,8 @@
 package controllers
 
 import (
+	"strings"
+
 	"github.com/gofiber/fiber/v2"
 	"github.com/sujit-baniya/fiber-boilerplate/pkg/models"
 	"github.com/sujit-baniya/fiber-boilerplate/pkg/services"
@@ -39,8 +41,8 @@ func SaveCloudflareConfig(c *fiber.Ctx) error {
 	}
 
 	cfg := models.CloudflareConfig{
-		APIToken:  b.APIToken,
-		AccountID: b.AccountID,
+		APIToken:  strings.TrimSpace(b.APIToken),
+		AccountID: strings.TrimSpace(b.AccountID),
 		Nota:      b.Nota,
 	}
 	cfg.ID = b.ID
@@ -58,7 +60,28 @@ func cloudflareClient() (*services.CloudflareClient, error) {
 	if err != nil {
 		return nil, err
 	}
-	return services.NewCloudflareClient(cfg.APIToken, cfg.AccountID), nil
+	return services.NewCloudflareClient(strings.TrimSpace(cfg.APIToken), strings.TrimSpace(cfg.AccountID)), nil
+}
+
+// VerifyCloudflareToken verifica que el token activo sea válido contra la API de Cloudflare.
+func VerifyCloudflareToken(c *fiber.Ctx) error {
+	cfg, err := models.GetCloudflareConfig()
+	if err != nil {
+		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{
+			"ok":    false,
+			"error": "No hay configuración activa de Cloudflare",
+		})
+	}
+	token := strings.TrimSpace(cfg.APIToken)
+	if token == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"ok": false, "error": "Token vacío"})
+	}
+	client := services.NewCloudflareClient(token, strings.TrimSpace(cfg.AccountID))
+	result, err := client.VerifyToken()
+	if err != nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"ok": false, "error": err.Error()})
+	}
+	return c.JSON(fiber.Map{"ok": true, "data": result})
 }
 
 // ─── Endpoints de datos ───────────────────────────────────────────────────────
diff --git a/rest/routes/user.go b/rest/routes/user.go
index ce6bd44..3da54e1 100755
--- a/rest/routes/user.go
+++ b/rest/routes/user.go
@@ -123,6 +123,7 @@ func UserRoutes(app fiber.Router) {
 	// ─── Cloudflare API ───────────────────────────────────────────────
 	protected.Get("/cloudflare", middlewares.MenuMiddleware, controllers.CloudflareConfigPage)
 	protected.Post("/cloudflare/config", controllers.SaveCloudflareConfig)
+	protected.Get("/cloudflare/verify", controllers.VerifyCloudflareToken)
 	protected.Get("/cloudflare/user", controllers.GetCloudflareUser)
 	protected.Get("/cloudflare/zones", controllers.GetCloudflareZones)
 	protected.Get("/cloudflare/zones/:zone_id/dns", controllers.GetCloudflareDNS)