Skip to content
Alchemy
GitHubXDiscordRSS

Cloudflare Auth

Configure Cloudflare authentication for your Alchemy applications. Learn to use API tokens, OAuth, or global API keys to securely manage Cloudflare resources.

There are three supported ways of authorizing Alchemy with Cloudflare:

  1. OAuth (recommended) - short-lived access and refresh tokens
  2. API Token - a token you create once with limited scopes
  3. Global API Key (legacy) - the global, highly permissive API key

OAuth

Section titled “OAuth”

To use OAuth with Cloudflare, create a Profile with alchemy configure and select OAuth for Cloudflare.

Once setup, you can refresh your OAuth tokens with Cloudflare using the alchemy login command:

Terminal window
bun alchemy login [--profile <profile>]

Then, deploy your app with alchemy deploy (or run another CLI command):

Terminal window
bun alchemy deploy

To select a specific profile, use the --profile flag:

Terminal window
bun alchemy deploy --profile <profile>

API Token

Section titled “API Token”

First, create an API Token and then use it in your Alchemy app.

By default, Alchemy will use the CLOUDFLARE_API_TOKEN environment variable if set.

You can store the token in your .env file

Terminal window
CLOUDFLARE_API_TOKEN=<token>

Or set when deploying your app:

Terminal window
CLOUDFLARE_API_TOKEN=<token> bun alchemy deploy

You can explciitly set an apiToken when creating a Cloudflare Resource, such as a Worker:

await Worker("my-worker", {
  apiToken: alchemy.secret(process.env.MY_TOKEN)
});

Global API Key

Section titled “Global API Key”

After you verify your Cloudflare Account’s Email, you will be given a Global API Key.

By default, Alchemy will use the CLOUDFLARE_API_KEY environment variable if set.

You can store the token in your .env file

Terminal window
CLOUDFLARE_API_KEY=<token>

Or set when deploying your app:

Terminal window
CLOUDFLARE_API_KEY=<token> bun alchemy deploy

You can explciitly set an apiKey when creating a Cloudflare Resource, such as a Worker:

await Worker("my-worker", {
  apiKey: alchemy.secret(process.env.MY_GLOBAL_KEY)
});

Email

Section titled “Email”

When using Global API Keys, Alchemy must be configured with the API Key’s email.

By default, Alchemy will use the CLOUDFLARE_EMAIL if set

Terminal window
CLOUDFLARE_EMAIL=me@example.com CLOUDFLARE_API_KEY=<token> bun alchemy deploy

You can explicitly set email when creating a Cloudlfare Resource:

await Worker("my-worker", {
  apiKey: alchemy.secret(process.env.MY_GLOBAL_KEY),
  email: "me@example.com"
});

Account ID

Section titled “Account ID”

By default, Alchemy will resolve the account ID from the Profile or look it up using your API Key or Token.

Terminal window
# will use wrangler login and resolve the first account you have acces to (ideal for personal accounts)
bun alchemy deploy

You can override the default account ID with the CLOUDFLARE_ACCOUNT_ID environment variable:

Terminal window
CLOUDFLARE_ACCOUNT_ID=<account-id> bun alchemy deploy

Or by setting accountId when creating a Cloudflare Resource:

await Worker("my-worker", {
  accountId: "my-account-id",
});