Permissions & privacy

This prototype requests account read access and permission to deploy Workers. Cloudflare’s permissions may cover existing Workers in the selected account. Only approve accounts you intend to use.

Temporary access

The installer handles OAuth tokens server-side. Tokens are stored in an isolated session for up to 15 minutes by default, bounded by token expiry. Completing handoff or disconnecting deletes the session and attempts to revoke the token. Expired sessions are rejected immediately; an alarm removes stored data and attempts revocation. Revocation can fail during an outage: use Cloudflare’s authorized-applications screen to revoke access yourself.

Your password is entered only on Cloudflare. This app does not use analytics, third-party scripts, or application request logging. Hosting and network providers may still process request metadata.

What stays in your account

The prototype creates one named Worker with an expiring owner-access credential. It does not install SAM or retain a Cloudflare deployment token in that Worker. Disconnecting does not delete that Worker. You can remove it through Cloudflare’s Workers dashboard.

Your choice

You can deploy this same installer yourself and register your own OAuth client. Source availability helps you review the app; it does not guarantee that a hosted operator cannot modify its deployment.