Cloudflare Pages

What it watches

Cloudflare Pages feeds Publishes — Every deploy gets a verdict within five minutes — as Publish Verification.

What Keelnest reads

API token · read Pages projects, deployments and variable names; list accounts.

Sites served by a Worker without a Pages project are watched from the URL alone, and stay on the five-minute poll: Workers Builds publishes its events to a Cloudflare Queue rather than to a webhook address.

Read-only, like every connection: Keelnest never refunds, charges, changes a price, edits a setting or an environment variable, merges on its own or runs a migration. The credential is checked with one read call before it is stored, encrypted at rest, and can be revoked at the provider at any time. Security says the whole of it.

How to connect

1. Create the api token. Cloudflare dashboard > My Profile > API Tokens > Create Token, with Account > Cloudflare Pages > Read and Account > Account Settings > Read. Open Cloudflare Pages.
2. Paste it into Keelnest. In your workspace, open Integrations, find Cloudflare Pages and press Connect. Keelnest makes one read call to confirm the credential works, stores it encrypted, and starts reading on the next five-minute tick.
3. Link the apps. Under Manage, pick which applications this account watches. An app linked to a host is checked the moment that host reports a deploy; an app linked to a payment or AI account starts building its baseline from that hour.

Deploy notifications

Cloudflare Pages can be told to call Keelnest when a deploy finishes, so verification starts within seconds of it instead of on the five-minute poll.

Where to set it up. Cloudflare → Notifications → Destinations → Webhooks → Create: name it Keelnest, paste the address below as the URL and the secret below as the Secret. Then Notifications → Add → Pages → “Project updates”: pick this project, tick Deployment success and Deployment failed, and send it to the Keelnest webhook you just made.

The address and the secret to paste are shown in Keelnest under Integrations › Cloudflare Pages › Manage, one pair per connected account.

How a delivery is checked. cf-webhook-auth: the secret Cloudflare was given when the webhook destination was created, sent on every request. Cloudflare signs nothing, so that header is compared against the secret and nothing else in the delivery is trusted. A delivery is never trusted on its own: it says which site to look at first, and every fact about the deploy is then read back from Cloudflare Pages’s API, so a forged or missed delivery changes nothing the next poll would not correct.

The webhook destination belongs to the whole Cloudflare account, so it is made once; the notification that uses it is chosen per Pages project.

Source: Cloudflare Pages’s documentation.

Start watching

Create a workspace and connect Cloudflare Pages from Integrations, or run the free check on any public URL first. All docs.