diff --git a/cmd/zz_gen_cmd_dnshelp.go b/cmd/zz_gen_cmd_dnshelp.go
index a9199404..e1d16ef0 100644
--- a/cmd/zz_gen_cmd_dnshelp.go
+++ b/cmd/zz_gen_cmd_dnshelp.go
@@ -216,8 +216,10 @@ func displayDNSHelp(name string) {
 		fmt.Fprintln(w)
 
 		fmt.Fprintln(w, `Credentials:`)
-		fmt.Fprintln(w, `	- "CLOUDFLARE_API_KEY":	API key`)
-		fmt.Fprintln(w, `	- "CLOUDFLARE_EMAIL":	Account email`)
+		fmt.Fprintln(w, `	- "CF_API_EMAIL":	Account email`)
+		fmt.Fprintln(w, `	- "CF_API_KEY":	API key`)
+		fmt.Fprintln(w, `	- "CLOUDFLARE_API_KEY":	Alias to CLOUDFLARE_API_KEY`)
+		fmt.Fprintln(w, `	- "CLOUDFLARE_EMAIL":	Alias to CF_API_EMAIL`)
 		fmt.Fprintln(w)
 
 		fmt.Fprintln(w, `Additional Configuration:`)
diff --git a/docs/content/dns/zz_gen_cloudflare.md b/docs/content/dns/zz_gen_cloudflare.md
index 774f7069..a030af98 100644
--- a/docs/content/dns/zz_gen_cloudflare.md
+++ b/docs/content/dns/zz_gen_cloudflare.md
@@ -33,8 +33,10 @@ lego --dns cloudflare --domains my.domain.com --email my@email.com run
 
 | Environment Variable Name | Description |
 |-----------------------|-------------|
-| `CLOUDFLARE_API_KEY` | API key |
-| `CLOUDFLARE_EMAIL` | Account email |
+| `CF_API_EMAIL` | Account email |
+| `CF_API_KEY` | API key |
+| `CLOUDFLARE_API_KEY` | Alias to CLOUDFLARE_API_KEY |
+| `CLOUDFLARE_EMAIL` | Alias to CF_API_EMAIL |
 
 The environment variable names can be suffixed by `_FILE` to reference a file instead of a value.
 More information [here](/lego/dns/#configuration-and-credentials).
@@ -52,6 +54,7 @@ More information [here](/lego/dns/#configuration-and-credentials).
 The environment variable names can be suffixed by `_FILE` to reference a file instead of a value.
 More information [here](/lego/dns/#configuration-and-credentials).
 
+The Global API Key needs to be used, not the Origin CA Key.
 
 
 
diff --git a/platform/config/env/env_test.go b/platform/config/env/env_test.go
index 57ba7ad2..db6aeaf0 100644
--- a/platform/config/env/env_test.go
+++ b/platform/config/env/env_test.go
@@ -85,7 +85,7 @@ func TestGetWithFallback(t *testing.T) {
 			},
 		},
 		{
-			desc:   "only all env vars have a value",
+			desc:   "all env vars in a groups have a value",
 			groups: [][]string{{"TEST_LEGO_VAR_EXIST_1", "TEST_LEGO_VAR_EXIST_2"}},
 			expected: expected{
 				value: map[string]string{"TEST_LEGO_VAR_EXIST_1": "VAR1"},
@@ -104,7 +104,6 @@ func TestGetWithFallback(t *testing.T) {
 			}
 		})
 	}
-
 }
 
 func TestGetOrDefaultInt(t *testing.T) {
diff --git a/providers/dns/cloudflare/cloudflare.toml b/providers/dns/cloudflare/cloudflare.toml
index 017c1192..d4e0a0fd 100644
--- a/providers/dns/cloudflare/cloudflare.toml
+++ b/providers/dns/cloudflare/cloudflare.toml
@@ -10,10 +10,16 @@ CLOUDFLARE_API_KEY=b9841238feb177a84330febba8a83208921177bffe733 \
 lego --dns cloudflare --domains my.domain.com --email my@email.com run
 '''
 
+Additional = '''
+The Global API Key needs to be used, not the Origin CA Key.
+'''
+
 [Configuration]
   [Configuration.Credentials]
-    CLOUDFLARE_EMAIL = "Account email"
-    CLOUDFLARE_API_KEY = "API key"
+    CF_API_EMAIL = "Account email"
+    CF_API_KEY = "API key"
+    CLOUDFLARE_EMAIL = "Alias to CF_API_EMAIL"
+    CLOUDFLARE_API_KEY = "Alias to CLOUDFLARE_API_KEY"
   [Configuration.Additional]
     CLOUDFLARE_POLLING_INTERVAL = "Time between DNS propagation check"
     CLOUDFLARE_PROPAGATION_TIMEOUT = "Maximum waiting time for DNS propagation"