You must use ddclient 3.9.1 onwards as cloudflare v4 API support does not exist in earlier versions and will fail with error code 1020.
You must also (correct as of ddclient version 3.9.1) use your Global API key and not a manually created token as only the Global API key uses X-Auth-Email
Example config:
Configuration file for ddclient generated by debconf
#
# /etc/ddclient.conf
daemon=3600
syslog=yes
ssl=yes # use ssl-support. Works with ssl-library
use=web, web=dynamicdns.park-your-domain.com/getip # How to obtain current IP
##
## Cloudflare
##
protocol=cloudflare
ttl=1
login=<CLOUDFLARE_EMAIL>
password=<CLOUDFLARE_GLOABL_API>
zone=<DNS_ZONE>
<DNS_ENTRY_FQDN>