Cloudflare

What it watches

Cloudflare feeds Publish Verification: every deploy gets a verdict within five minutes.

What Keelnest reads

• Credential: API token.
• Reads: Workers, Pages projects, their deploys and variable names; list accounts.

Worker deploys are found on the five-minute poll: Workers Builds sends its events to a Cloudflare Queue, not to a webhook. Without Workers Builds access, a Worker deploy shows no commit and its branch previews are not checked. A Worker on a route in front of another host is never taken for an app's host, so that app is still watched from its live site.

Read-only, like every connection: Keelnest never refunds, charges, changes a price, edits a setting or an environment variable, merges on its own or runs a migration. The credential is checked with one read call before it is stored, encrypted at rest, and can be revoked at the provider at any time. Security says the whole of it.

How to connect

1. Create the API token. Open the pre-filled token form.
   1. Open the pre-filled token form. It already asks for Workers Scripts, Cloudflare Pages and Account Settings, all Read.
   2. Optional: add Account > Workers Builds Configuration > Read, so Worker deploys show their commit and branch previews get checked.
   3. Keep Account Resources on All accounts, or pick the accounts your apps are on.
   4. Choose Continue to summary, then Create Token. Copy the token: Cloudflare shows it only once.

   Workers Builds knows which commit each Worker deploy came from and where each branch preview lives. Without it, Worker deploys are still checked; they show no commit, and branch previews are not checked. Cloudflare's API reference calls this permission Workers CI Read.

2. Paste it into Keelnest. In your workspace, open Integrations, find Cloudflare and press Connect. Keelnest makes one read call to confirm the credential works, stores it encrypted, and starts reading on the next five-minute tick.
3. Link the apps. Under Manage, pick which applications this account watches. An app linked to a host is checked the moment that host reports a deploy; an app linked to a payment or AI account starts building its baseline from that hour.

Add the missing access to your token

1. Open API Tokens in Cloudflare.
2. Next to the token you gave Keelnest, select the three dots, then Edit.
3. Add Account > Workers Scripts > Read (or Account > Cloudflare Pages > Read, whichever is missing). For Worker commits, also add Account > Workers Builds Configuration > Read.
4. Continue to summary and save. The token itself does not change. Then:
   • If Keelnest shows the account as Connected: Nothing more to do. The next check, within five minutes, reads the rest.
   • If it shows Needs attention: Open Integrations in Keelnest, press Reconnect on the Cloudflare account and paste the same token, so Keelnest checks it again now.

Open API Tokens in Cloudflare.

Deploy notifications

Cloudflare can be told to call Keelnest when a deploy finishes, so verification starts within seconds of it instead of on the five-minute poll.

Where to set it up. Cloudflare → Notifications → Destinations → Webhooks → Create: name it Keelnest, paste the address below as the URL and the secret below as the Secret. Then Notifications → Add → Pages → “Project updates”: pick this project, tick Deployment success and Deployment failed, and send it to the Keelnest webhook you just made.

The address and the secret to paste are shown in Keelnest under Integrations › Cloudflare › Manage, one pair per connected account.

How a delivery is checked. cf-webhook-auth: the secret Cloudflare was given when the webhook destination was created, sent on every request. Cloudflare signs nothing, so that header is compared against the secret and nothing else in the delivery is trusted. A delivery is never trusted on its own: it says which site to look at first, and every fact about the deploy is then read back from Cloudflare’s API, so a forged or missed delivery changes nothing the next poll would not correct.

The webhook destination belongs to the whole Cloudflare account, so it is made once; the notification that uses it is chosen per Pages project. Workers need no webhook: their deploys are found on the five-minute poll.

Source: Cloudflare’s documentation.