Docs / Onboarding

Connecting your Cloudflare account

How the one-broad-token → narrow-working-token bootstrap works and what permissions we need.

Heads up: Cloudflare Pages is the only deploy target open to self-serve today — it's the fastest path to a live URL and free for our typical site sizes. Netlify and your-own-server targets are in final testing and open to all tenants over the next few weeks. This guide covers the Cloudflare path.

Why we need a Cloudflare account

Site Generator doesn't host your sites. Every deploy lands on a Pages project under your Cloudflare account — that's the static-export contract. You own the infrastructure, we own the build pipeline.

To deploy on your behalf, we need a CF API token scoped to Cloudflare Pages → Edit on a specific account. We mint that token from a one-time broader token you generate, then immediately discard the broader credential.

The bootstrap flow

  1. From the cabinet, click Connect Cloudflare. We show you a CF dashboard link that pre-fills the token-creation form with the exact permissions we need.
  2. You create the broad token, copy it, and paste it into the cabinet.
  3. The platform uses the broad token to provision a narrow working token scoped just to Pages:Edit on the account you nominate, stores the narrow token, and discards the broad one.
  4. Subsequent deploys use the narrow token. You can rotate it from the cabinet at any time.

What gets stored

  • Narrow API token — encrypted at rest, used for Pages deploy + Zone Rules provisioning (when you attach a domain).
  • Account reference — your CF account ID, so we know which account to deploy to.
  • Pages project name — auto-created on first deploy (generator-<siteId>) or pre-existing if you nominate one.

We don't store the broader token, your CF dashboard credentials, or any other Cloudflare data.

Disconnecting

From the cabinet, click Disconnect Cloudflare. We delete the narrow token immediately. Deployed bundles stay live on your CF account until you remove them from the Pages dashboard there — Site Generator only controls the build pipeline, not the running infrastructure.

What if I want to use my own CF Pages project name?

Pre-create the project in the CF dashboard, then enter its name in the cabinet'sDeploy config. We'll use it as-is instead of auto-creating one.

Does the narrow token expire?

Not unless you set an expiry when creating it (we don't). Rotate it from the cabinet if you're concerned about long-lived credentials.

I already have a CF Pages project for this site — can I just point at it?

Yes. The bootstrap detects existing projects when you nominate the name. Subsequent deploys go to the same project.