Cloudflare integration: connect Workers, Pages, R2 and D1 to Polylane
Connect Cloudflare Workers, Pages, R2 and D1 to Polylane with a read-only token. Follow bindings and deployment changes to investigate edge failures.
Get started for freeHow to set up Cloudflare
The flow validates the pasted token before connection. No measured end-to-end setup duration is published; allow for token creation and initial resource discovery.
- In Polylane, choose Cloudflare under Settings → Cloud accounts and open Create API token.
- Select the Cloudflare account. Creating an account-owned token requires Super Administrator; full resource discovery requires the Workers Paid plan.
- Keep the pre-filled read-only permissions, create the token and paste it into the connection form. Wait for validation, then connect.
Permissions and access
The current console requests an account-owned read-only token, not a full-access token. Its template includes Workers scripts, content and metadata reads; Workers observability and tail; Pages, KV, R2 Storage, D1, Queues, Hyperdrive, Vectorize, AI Gateway, DNS, zone settings, Access, tunnels, analytics and other account resource reads. Edit grants are converted to Read; action-only Run, Send and Purge grants are dropped. R2 object permissions are excluded. The complete template key list is available below. No full-access option is offered by this connection form.
Discovery, refresh and the connected view
A scheduled check runs every 15 minutes and requests a resource sync when account changes warrant one; it is not an unconditional full scan every 15 minutes. Workers, bindings, Pages, Durable Objects, databases, storage, queues, zones and the supported resources below appear as linked nodes with configuration and change history.
Disconnect and revoke access
Disconnect the account in Polylane to stop syncing, then revoke the account API token in Cloudflare. An account-owned token survives the departure of its creator until it is revoked.
Provider credentials and Polylane’s access mode are separate. Where write-capable tools exist, the connected account’s Settings page offers a Read-only switch. Turning it off permits writes subject to review and confirmation, but cannot add permissions to the provider credential. Agent-connected Kubernetes clusters stay read-only.
Exact Cloudflare token template permissions
Every key below uses type read, except the two Workers keys marked only. The current console does not request the full-access template.
access:readaccess_acct:readaccess_app:readaccess_audit_log:readaccess_certificate:readaccess_custom_page:readaccess_device_posture:readaccess_group:readaccess_idp:readaccess_key:readaccess_org:readaccess_policy:readaccess_policy_test:readaccess_population:readaccess_saml_certificate:readaccess_scim_log:readaccess_service_token:readaccess_ssh_auditing:readaccess_tag:readaccess_users:readaccount_abuse_protection_pii:readaccount_analytics:readaccount_api_gateway:readaccount_api_tokens:readaccount_custom_asset:readaccount_custom_error_rules:readaccount_custom_pages:readaccount_disable_esc:readaccount_dns_settings:readaccount_firewall_access_rules:readaccount_logs:readaccount_rule_lists:readaccount_rule_policies:readaccount_rulesets:readaccount_security_center_insights:readaccount_settings:readaccount_ssl_and_certificates:readaccount_waf:readaccount_waiting_rooms:readaddress_maps:readagw:readai:readai_search:readai_search_metadata:readaiaudit:readaig:readanalytics:readapi_gateway:readargotunnel:readartifacts:readbilling:readbot_management:readbot_management_feedback:readbrowser_rendering:readcache_settings:readcalls:readcasb:readcf_agents:readchallenge_widgets:readchinanetwork_steering:readcloud_connector:readcloud_email_security:readcloudchamber:readcloudforce_one:readconfig_settings:readconnectivity_directory:readconstellation:readcontainers:readcustom_errors:readcustom_pages:readd1:readd1_metadata:readddos_botnet_feed:readddos_protection:readdls:readdns:readdns_firewall:readdns_view:readdomain_page_shield:readdynamic_redirect:reademail_routing_address:reademail_routing_rule:reademail_routing_suppression:reademail_security_dmarcreports:reademail_sending:readfbm:readfirewall_for_ai:readfirewall_services:readflagship:readfraud_detection:readhealthcheck:readhttp_applications:readhttp_ddos_managed_ruleset:readimages:readimages_metadata:readintel:readiot:readip_prefix:readip_prefix_bgp_on_demand:readl4_ddos_managed_ruleset:readload_balancers:readload_balancers_account:readload_balancing_monitors_and_pools:readlogs:readmagic_firewall:readmagic_transit:readmagic_wan:readmanaged_headers:readmass_url_redirects:readmcp_portals:readmoq:readnotifications:readoauth_client:readorigin:readpage:readpage_rules:readpage_shield:readpcaps_api:readpipelines:readpubsub:readquery_cache:readqueues:readqueues_metadata:readr2_catalog:readr2_catalog_sql:readradar:readrag:readrealtime:readregistrar_domains:readreports_application_security_report:readrequest_tracer:readresource_library:readresource_sharing:readresponse_compression:readsanitize:readsecrets_store:readselect_configuration:readsnippets:readssl_and_certificates:readsso_connector:readstream:readstream_metadata:readtag:readteams:readteams_cds_compute_account:readteams_connector_cloudflared:readteams_connector_warp:readteams_connectors:readteams_dex:readteams_networks:readteams_pii:readteams_resilience:readtransform_rules:readtrust_and_safety:readurl_scanner:readvectorize:readwaiting_rooms:readweb3_hostnames:readworkers_ci:readworkers_kv_storage:readworkers_kv_storage_metadata:readworkers_observability:readworkers_r2:readworkers_r2_metadata:readworkers_routes:readworkers_scripts:readworkers_tail:readzaraz:readzone:readzone_access:readzone_custom_asset:readzone_disable_esc:readzone_dns_settings:readzone_security_center_insights:readzone_settings:readzone_transform_rules:readzone_versioning:readzone_waf:readworkers_content_read:onlyworkers_metadata_read:only
In the graph.
Every Cloudflare resource Polylane picks up sits in the graph with its connections, config and history.
Cloudflare Worker 
AI Gateway 
Cloudflare Container 
Durable Object 
D1 Database 
Hyperdrive 
Cloudflare KV 
Cloudflare Pipeline Pipeline Stream Pipeline Sink 
R2 Bucket 
R2 Domain 
Cloudflare Queue 
Secret Store Cloudflare Secret 
Cloudflare Pages Domain 
AI 
Analytics Engine 
Browser Rendering 
Vectorize 
Cloudflare Workflow Cloudflare Zone Worker Route Worker Domain 
Dispatch Namespace Tenant Worker Snippet 
mTLS Certificate 
Cloudflare Tunnel 
Access Application 
Spectrum App 
Turnstile Widget 
Waiting Room 
Health Check 
Load Balancer Load Balancer Pool Load Balancer Monitor 
Logpush Job SSL Certificate 
Email Address 
Stream Live Input 
Cloudflare Images 
Calls App 
AutoRAG 
R2 Data Catalog 
Artifacts Namespace Tools for the investigation.
What Polylane can do with Cloudflare while it investigates. Every call is recorded in the transcript.
Cloudflare Polylane MCP -
cloudflareListTelemetryKeysList available Cloudflare telemetry data keys -
cloudflareListTelemetryValuesList values for a Cloudflare telemetry key -
cloudflareRunTelemetryQueryQuery Cloudflare Workers / container logs, traces, and AI Gateway request logs -
cloudflareTracesRead Cloudflare traces (list summaries, get full span tree) -
cloudflareRunGraphqlQueryExecute a GraphQL query against the Cloudflare Analytics API -
cloudflareGraphqlSchemaSearchSearch the Cloudflare GraphQL schema for matching types, fields, args, and enum values -
cloudflareGraphqlSchemaOverviewFetch a paginated overview of all Cloudflare GraphQL types -
cloudflareGraphqlTypeDetailsFetch fields, args, and enum values for one Cloudflare GraphQL type -
cloudflareGraphqlCompleteSchemaFetch the Cloudflare GraphQL schema with optional root-type details -
cloudflareAiGatewayLogsList Cloudflare AI Gateway logs, or fetch one log's full detail -
cloudflareAccessApplicationLogsList Cloudflare Access authentication events for an Access application -
cloudflareWorkflowInstancesList or get Cloudflare Workflows instances -
cloudflareApiCall any Cloudflare REST API endpoint that lacks a dedicated tool -
cloudflareDeploymentsList Cloudflare Worker/Pages deployments or Worker versions
Cloudflare setup and troubleshooting
Docker context deadline exceeded
Common questions.
How does Polylane connect to my Cloudflare account?
In Polylane, choose Cloudflare under Settings → Cloud accounts and open Create API token. Select the Cloudflare account. Creating an account-owned token requires Super Administrator; full resource discovery requires the Workers Paid plan. Keep the pre-filled read-only permissions, create the token and paste it into the connection form. Wait for validation, then connect.
What Cloudflare resources does Polylane sync?
A scheduled check runs every 15 minutes and requests a resource sync when account changes warrant one; it is not an unconditional full scan every 15 minutes. Workers, bindings, Pages, Durable Objects, databases, storage, queues, zones and the supported resources below appear as linked nodes with configuration and change history.