LEARN IT. BUILD WITH IT.
The Cloudflare Field Manual
Practical Cloudflare development, from first Worker to production operations

About this workbook
A practical guide to Cloudflare Workers, Workflows, Durable Objects, storage, security and observability. Combines getting-started chapters, platform references, implementation patterns and field notes from production systems.
THE COMPLETE READING PATH
Explore the chapters.
Read in order or go straight to the problem you are working on. Every chapter is available online.
Part 1: Workers
- Worker fetch to a hostname on your own zone fails with error 1042 2 min
- A hand-rolled caches.default layer cached one error for 24 hours 2 min
- A 150-line deploy: read live version id, probe /health, auto-rollback 3 min
- An MCP server as one Pages Function: stateless Streamable HTTP 3 min
- Start with one Worker and a router; split only when a boundary appears 2 min
- compatibility_date is a runtime pin; bump it on purpose, alone 2 min
- wrangler dev is local by default; opt bindings into remote one by one 2 min
- Test a Worker inside workerd with the Vitest plugin, not in Node 3 min
- Call a private Worker over a Service Binding: no URL, no latency 3 min
- ctx.waitUntil buys thirty seconds after the response, not forever 2 min
- Workers limits are CPU time, not wall time; waiting on fetch is free 3 min
- Static assets from the Worker; run_worker_first decides who answers 3 min
- Named environments inherit nothing that binds: vars, bindings, crons 3 min
- Roll a version to 10% first: versions upload, then deploy with a split 3 min
- CI deploys: scoped API token, wrangler pinned, migrations before code 3 min
- Email at the edge: a send_email binding to send, email() to receive 3 min
- caches.default is manual; Workers Caching is read-through with purge 3 min
Part 2: Workflows
- WorkflowStep is an RPC receiver, so step.do.bind() throws 2 min
- The 21-second production canary: pin, diff 82 bindings, roll back 3 min
Part 3: Queues & Crons
- One */15 cron, many legs, each isolated in its own waitUntil 3 min
- Our fail-closed cron gate was the outage: 11 silent days 3 min
- One scheduled() handler serves every cron; controller.cron says which 3 min
- A Queue consumer gets batches; ack per message, retry only failures 3 min
- Queue work returns 202; the client polls a status row 3 min
Part 4: Observability
- Cron dead-man's switch: heartbeat per tick, alert on the lower bound 2 min
- Check provider balances on a cron; a card lapse killed runs for 24 h 3 min
- Workers Logs is for last week; wrangler tail is for right now 3 min
Part 5: KV/R2/D1
- wrangler kv/r2 (v4) targets the local simulator unless --remote 2 min
- Pick the R2 public domain once; URLs get baked into content 2 min
- Restic to R2 plus binlog shipping: a restore drill in 24 s, RPO 119 s 3 min
- KV is a cache with sixty-second edges, not a database 3 min
- Cache upstream JSON in KV with a TTL; serve stale when upstream fails 3 min
- Upload to R2 through the Worker; presign a PUT for big files 3 min
- Serve R2 objects with their own headers, ETag and Range support 2 min
- D1: numbered migrations, prepare().bind(), batch() for atomicity 3 min
- D1 read replicas: withSession() plus a bookmark across requests 2 min
- Hyperdrive pools Postgres connections so Workers skip the handshake 3 min
Part 6: Zone
- Make a Webflow page the homepage with a URL rewrite, not a Worker 2 min
- Custom Domains make the Worker the origin; Routes put it in front 3 min
Part 7: Security
- Kill switch as a Worker var: fail closed; spend ceilings: fail open 3 min
- Mint scoped Cloudflare tokens from a master token; use, then delete 3 min
- Credential-free edge companion: the customer pastes a Snippet 3 min
- Put Cloudflare Access in front of a Worker, then verify its JWT too 3 min
- Turnstile is only a widget until the Worker calls siteverify 2 min
- The Rate Limiting binding counts per key inside the Worker 2 min
- Declare required secrets; the deploy fails when one is missing 2 min
Part 8: Migrating from n8n
- Compile n8n Code nodes mechanically; hash every node's parameters 3 min
- Failover from n8n to a Workflow: three bindings, one executor per run 4 min
Part 9: Analytics Engine
Part 10: Pages
- Pages production branch isn't main: --branch main lands a preview 2 min
- Pages _middleware.js: Accept text/markdown serves the .md sibling 2 min
- New static site? Workers with static assets, not Pages 2 min
- Pages Functions route by file path; _middleware.js wraps the rest 3 min
Part 11: AI
- Workers AI: env.AI.run(model, input); stream text, send bytes 3 min
- Put AI Gateway in front of every provider call: logs, cache, retries 3 min
- Vectorize is the vector store; pair it with an embedding model 3 min
Part 12: Durable Objects
- A Durable Object is one single-threaded instance per id, with SQLite 3 min
- Hibernating WebSockets in a Durable Object: idle rooms cost nothing 3 min
- Durable Object alarms are per-object timers; crons are global 2 min
Part 13: Getting Started
Want help applying the ideas?
Bring the workflow you want to build or improve.