LEARN IT. BUILD WITH IT.

The Cloudflare Field Manual

Practical Cloudflare development, from first Worker to production operations

Free to read online
The Cloudflare Field Manual

About this workbook

A practical guide to Cloudflare Workers, Workflows, Durable Objects, storage, security and observability. Combines getting-started chapters, platform references, implementation patterns and field notes from production systems.

THE COMPLETE READING PATH

Explore the chapters.

Read in order or go straight to the problem you are working on. Every chapter is available online.

Part 1: Workers

  1. Worker fetch to a hostname on your own zone fails with error 1042 2 min
  2. A hand-rolled caches.default layer cached one error for 24 hours 2 min
  3. A 150-line deploy: read live version id, probe /health, auto-rollback 3 min
  4. An MCP server as one Pages Function: stateless Streamable HTTP 3 min
  5. Start with one Worker and a router; split only when a boundary appears 2 min
  6. compatibility_date is a runtime pin; bump it on purpose, alone 2 min
  7. wrangler dev is local by default; opt bindings into remote one by one 2 min
  8. Test a Worker inside workerd with the Vitest plugin, not in Node 3 min
  9. Call a private Worker over a Service Binding: no URL, no latency 3 min
  10. ctx.waitUntil buys thirty seconds after the response, not forever 2 min
  11. Workers limits are CPU time, not wall time; waiting on fetch is free 3 min
  12. Static assets from the Worker; run_worker_first decides who answers 3 min
  13. Named environments inherit nothing that binds: vars, bindings, crons 3 min
  14. Roll a version to 10% first: versions upload, then deploy with a split 3 min
  15. CI deploys: scoped API token, wrangler pinned, migrations before code 3 min
  16. Email at the edge: a send_email binding to send, email() to receive 3 min
  17. caches.default is manual; Workers Caching is read-through with purge 3 min

Part 2: Workflows

  1. WorkflowStep is an RPC receiver, so step.do.bind() throws 2 min
  2. The 21-second production canary: pin, diff 82 bindings, roll back 3 min

Part 3: Queues & Crons

  1. One */15 cron, many legs, each isolated in its own waitUntil 3 min
  2. Our fail-closed cron gate was the outage: 11 silent days 3 min
  3. One scheduled() handler serves every cron; controller.cron says which 3 min
  4. A Queue consumer gets batches; ack per message, retry only failures 3 min
  5. Queue work returns 202; the client polls a status row 3 min

Part 4: Observability

  1. Cron dead-man's switch: heartbeat per tick, alert on the lower bound 2 min
  2. Check provider balances on a cron; a card lapse killed runs for 24 h 3 min
  3. Workers Logs is for last week; wrangler tail is for right now 3 min

Part 5: KV/R2/D1

  1. wrangler kv/r2 (v4) targets the local simulator unless --remote 2 min
  2. Pick the R2 public domain once; URLs get baked into content 2 min
  3. Restic to R2 plus binlog shipping: a restore drill in 24 s, RPO 119 s 3 min
  4. KV is a cache with sixty-second edges, not a database 3 min
  5. Cache upstream JSON in KV with a TTL; serve stale when upstream fails 3 min
  6. Upload to R2 through the Worker; presign a PUT for big files 3 min
  7. Serve R2 objects with their own headers, ETag and Range support 2 min
  8. D1: numbered migrations, prepare().bind(), batch() for atomicity 3 min
  9. D1 read replicas: withSession() plus a bookmark across requests 2 min
  10. Hyperdrive pools Postgres connections so Workers skip the handshake 3 min

Part 6: Zone

  1. Make a Webflow page the homepage with a URL rewrite, not a Worker 2 min
  2. Custom Domains make the Worker the origin; Routes put it in front 3 min

Part 7: Security

  1. Kill switch as a Worker var: fail closed; spend ceilings: fail open 3 min
  2. Mint scoped Cloudflare tokens from a master token; use, then delete 3 min
  3. Credential-free edge companion: the customer pastes a Snippet 3 min
  4. Put Cloudflare Access in front of a Worker, then verify its JWT too 3 min
  5. Turnstile is only a widget until the Worker calls siteverify 2 min
  6. The Rate Limiting binding counts per key inside the Worker 2 min
  7. Declare required secrets; the deploy fails when one is missing 2 min

Part 8: Migrating from n8n

  1. Compile n8n Code nodes mechanically; hash every node's parameters 3 min
  2. Failover from n8n to a Workflow: three bindings, one executor per run 4 min

Part 9: Analytics Engine

  1. Analytics Engine as cookie-less telemetry: blobs are positional 3 min

Part 10: Pages

  1. Pages production branch isn't main: --branch main lands a preview 2 min
  2. Pages _middleware.js: Accept text/markdown serves the .md sibling 2 min
  3. New static site? Workers with static assets, not Pages 2 min
  4. Pages Functions route by file path; _middleware.js wraps the rest 3 min

Part 11: AI

  1. Workers AI: env.AI.run(model, input); stream text, send bytes 3 min
  2. Put AI Gateway in front of every provider call: logs, cache, retries 3 min
  3. Vectorize is the vector store; pair it with an embedding model 3 min

Part 12: Durable Objects

  1. A Durable Object is one single-threaded instance per id, with SQLite 3 min
  2. Hibernating WebSockets in a Durable Object: idle rooms cost nothing 3 min
  3. Durable Object alarms are per-object timers; crons are global 2 min

Part 13: Getting Started

  1. A Worker is a fetch handler plus bindings; Wrangler is the toolchain 3 min
  2. Create, run locally and deploy a Worker in five commands 3 min
  3. Vars, secrets and bindings all arrive on env; they are not the same 3 min

Want help applying the ideas?

Bring the workflow you want to build or improve.