Skip to content
Alchemy
GitHubXDiscordRSS

Cloudflare Auth

There are three supported ways of authorizing Alchemy with Cloudflare:

  1. API Token - a token you create once with limited scopes
  2. OAuth - a token created by wrangler login
  3. Global API Key (legacy) - the global, highly permissive API key

API Token

Section titled “API Token”

First you need to create an API Token and then use it in your Alchemy app.

By default, Alchemy will use the CLOUDFLARE_API_TOKEN environment variable if set.

You can store the token in your .env file

Terminal window
CLOUDFLARE_API_TOKEN=<token>

Or set when deploying your app:

Terminal window
CLOUDFLARE_API_TOKEN=<token> bun alchemy deploy

You can explciitly set an apiToken when creating a Cloudflare Resource, such as a Worker:

await Worker("my-worker", {
  apiToken: alchemy.secret(process.env.MY_TOKEN)
});

OAuth Token

Section titled “OAuth Token”

If you don’t specify CLOUDFLARE_API_KEY or CLOUDFLARE_API_TOKEN, then Alchemy will use the OAuth Token and Refresh Token to authenticate with Cloudflare.

First, make sure you’ve logged in with wrangler:

Terminal window
bun wrangler login

Then, deploy your app (without CLOUDFLARE_API_KEY or CLOUDFLARE_API_TOKEN environment variables):

Terminal window
bun alchemy deploy

Global API Key

Section titled “Global API Key”

After you verify your Cloudflare Account’s Email, you will be given a Global API Key.

By default, Alchemy will use the CLOUDFLARE_API_KEY environment variable if set.

You can store the token in your .env file

Terminal window
CLOUDFLARE_API_KEY=<token>

Or set when deploying your app:

Terminal window
CLOUDFLARE_API_KEY=<token> bun alchemy deploy

You can explciitly set an apiKey when creating a Cloudflare Resource, such as a Worker:

await Worker("my-worker", {
  apiKey: alchemy.secret(process.env.MY_GLOBAL_KEY)
});

Email

Section titled “Email”

When using Global API Keys, Alchemy must be configured with the API Key’s email.

By default, Alchemy will use the CLOUDFLARE_EMAIL if set

Terminal window
CLOUDFLARE_EMAIL=me@example.com CLOUDFLARE_API_KEY=<token> bun alchemy deploy

You can explicitly set email when creating a Cloudlfare Resource:

await Worker("my-worker", {
  apiKey: alchemy.secret(process.env.MY_GLOBAL_KEY),
  email: "me@example.com"
});

Account ID

Section titled “Account ID”

By default, Alchemy will resolve the account ID from the API or OAuth token.

Terminal window
# will use wrangler login and resolve the first account you have acces to (ideal for personal accounts)
bun alchemy deploy

You can override the default account ID with the CLOUDFLARE_ACCOUNT_ID environment variable:

Terminal window
CLOUDFLARE_ACCOUNT_ID=<account-id> bun alchemy deploy

Or by setting accountId when creating a Cloudflare Resource:

await Worker("my-worker", {
  accountId: "my-account-id",
});