Managing it for others.
WHOSE ACCOUNT
The client's. Their domain, their DNS, their account.
For the same reason a client's domain should be registered in their name: if the relationship ends, they must retain control.
IF IT IS IN YOUR ACCOUNT
Agree in writing what happens when the engagement ends, and how it transfers.
Moving a zone between Cloudflare accounts requires the nameservers to change, which is disruptive if done under pressure.
GIVING YOURSELF ACCESS
Cloudflare supports inviting a user to an account with defined permissions.
That is the correct arrangement: their account, your access.
WHAT TO DOCUMENT PER SITE
Which records are proxied The SSL mode Any page rules or firewall rules Where the zone export is kept
KEEPING CONFIGURATIONS CONSISTENT
A written checklist applied to every site. Settings do not carry between zones, and drift is the usual outcome otherwise.
THE COMMON FAILURE
A second or third client site added and left on default Flexible SSL, producing a redirect loop on that site alone.
Check the SSL mode on every zone.
