Skip to content
bohrbohr docs

Connect Cloudflare

bohr creates each project’s Worker, the agent’s sandbox and the preview in your Cloudflare account, with an API token you give it. The instance keeps the token encrypted and only uses it to create and update your projects’ Workers.

Before you start

Section titled “Before you start”
  • The account must be on the Workers Paid plan: the agent’s sandbox is a Cloudflare Container.
  • The account needs a workers.dev subdomain. If you never opened Workers & Pages in the Cloudflare dashboard, open it once: that creates the subdomain.

Create the token

Section titled “Create the token”
  1. In the Cloudflare step, click Create the token on Cloudflare. It opens Cloudflare’s token page with the main permissions filled in.
  2. Before saving, add the Containers: Edit permission. The link cannot fill it in.
  3. Create the token, copy it, paste it in Cloudflare API token and click Connect.

The token needs these permissions:

Permission Why
Workers Scripts: Edit Creates the project Workers. It also covers Durable Objects and the workers.dev subdomain.
Account Settings: Read Reads the account’s details.
Containers: Edit The agent’s sandbox. Needs the Workers Paid plan. Add it by hand.
D1: Edit Creates the database of projects started from a template. Filled in by the link; only template projects need it.

When something is missing, the panel shows “The token lacks some permissions” with the list. Edit the token on Cloudflare (or create another one from the template), add what is missing and paste it again.

Several accounts

Section titled “Several accounts”

If the token can see more than one Cloudflare account, bohr asks Choose the Cloudflare account: pick the one your projects should run in and click Use this account.

What bohr leaves in your account

Section titled “What bohr leaves in your account”

So you can tell bohr’s work apart from yours:

  • Every Cloudflare API call bohr makes sends User-Agent: bohr/<version> (+https://bohr.io); it shows in your account’s audit log.
  • The Workers bohr creates (each project’s agent Worker and preview Worker) carry the tags bohr and bohr-project:<id>, and their deployments the message bohr.
  • Production deploys run wrangler deploy --message "bohr" --tag "bohr-<commit>".

Later

Section titled “Later”
  • Connected accounts are listed in Account › Connected accounts › Cloudflare. You can disconnect an account once no project uses it; also delete the token in the Cloudflare dashboard (My Profile → API Tokens).
  • An organization connects its own Cloudflare account, separate from yours.