Cloudflare OS configuration works at two layers. Environment variables are the “hard” layer — set at deploy time in wrangler secrets or inDocumentation Index
Fetch the complete documentation index at: https://mintlify.com/cloudflare/cloudflare-os/llms.txt
Use this file to discover all available pages before exploring further.
.dev.vars for local development, they control authentication, AI Gateway routing, and the public URL. The admin panel is the “soft” layer — settings stored in a KV-backed Durable Object and editable at runtime from /admin, covering branding, agent instructions, and which gatekeepers are offered to users.
Environment variables
These variables are read by theworkshop-backend Worker at startup. In local development, set them in the root .dev.vars file. In production, set them as wrangler secrets or in your wrangler.jsonc [vars] block.
| Variable | Description | Default |
|---|---|---|
PUBLIC_BASE_URL | The externally reachable base URL of your deployment (e.g. https://os.example.com). Used to construct OAuth redirect URIs and inter-service links. | http://localhost:8787 in dev |
AUTH_GATEKEEPERS | Comma-separated list of gatekeeper vendor IDs that may be used for sign-in (e.g. cloudflare,google,github). Each listed vendor shows a “Continue with …” button on the login page. Order determines button order. | "" (disabled — username/password only) |
DISABLE_PASSWORD_AUTH | Set to true to hide the username/password form and require gatekeeper sign-in. Ignored if AUTH_GATEKEEPERS is empty, to prevent lockout. | false |
ADMINS | Comma-separated (or JSON array) list of usernames granted admin access. Admin users can reach /admin and call AdminApi methods. | ["admin"] in dev |
ENABLE_CLOUDFLARE_LIMITS | Set to true to enable the free daily AI allowance + Cloudflare-credits top-up billing flow. When unset, all users get unlimited AI usage. | unset (unlimited) |
CF_AI_GATEWAY | Cloudflare AI Gateway ID used for free-tier inference. All providers listed in CF_AI_GATEWAY_PROVIDERS are routed through this gateway over HTTPS. Required when ENABLE_CLOUDFLARE_LIMITS=true. | unset |
CF_AI_GATEWAY_PROVIDERS | Comma-separated list of AI providers routed through CF_AI_GATEWAY (e.g. anthropic,openai,google). | unset |
CF_AI_GATEWAY_ACCOUNT_ID | ID of the Cloudflare account that owns the AI Gateway. Required whenever CF_AI_GATEWAY is set — inference calls go over HTTPS using this account. | unset |
CF_AI_GATEWAY_API_TOKEN | Cloudflare API token with AI Gateway Run and AI Gateway Read permissions. Run lets Gadgets execute models; Read lets them retrieve per-request cost logs for user-visible accounting. | unset |
CF_AI_GATEWAY_WAI | Alternative AI Gateway ID for Workers AI requests within the same account. Defaults to CF_AI_GATEWAY when unset. | unset |
CF_AI_GATEWAY_WAI_DIRECT | Set to true to bypass the gateway for Workers AI and call the Workers AI REST endpoint directly. Such requests produce no cost logs. | unset |
DAILY_LLM_CALL_LIMIT | Number of free LLM calls each user gets per UTC day. Only effective when ENABLE_CLOUDFLARE_LIMITS=true. | 100 |
MINIMUM_CLOUDFLARE_BALANCE | Minimum connected Cloudflare account balance (USD) required to route inference through the user’s own account (BYOK). | 2 |
Authentication and authorization configuration — specifically
AUTH_GATEKEEPERS, DISABLE_PASSWORD_AUTH, and ADMINS — is intentionally kept environment-variable driven and is not editable from the admin panel. This means a compromised admin session cannot lock users out or grant itself broader sign-in capabilities. These variables are read from auth/config.ts on every request, not from the KV-backed AdminConfig.Admin panel settings (AdminConfig)
The admin panel at/admin exposes “soft” configuration that can be changed at runtime without redeploying. These settings are stored in the AdminSettings Durable Object and mirrored to a reserved KV key so agent and connect paths can read them cheaply on every request.
All settings default to their enabled/empty state — the admin panel opts things out rather than in.
| Setting | Type | Description |
|---|---|---|
signupsEnabled | boolean | Allow new account creation. Defaults to true. Toggle off for a closed deployment after initial setup. |
siteName | string | Display name shown next to the logo in the top bar. Leave empty to use the default name. |
siteLogoConfigured | boolean | Whether a custom site logo image has been uploaded. Set automatically when you upload a logo via the admin UI. |
instanceInstructions | string | Extra instructions appended to the agent system prompt for every conversation on this deployment. Useful for company-specific context or behavioral guidelines. |
announcement | string | Markdown-formatted notice displayed in a centered top-bar banner, visible to all users. Useful for maintenance notices or welcome messages. |
banner | { text, color } | Full-width top-bar banner with a text message and an accent color. |
accentColor | string | Brand color hex (e.g. #F6821F) that overrides the default theme color throughout the UI. Leave empty for the default. |
disabledGatekeepers | string[] | Vendor IDs of gatekeepers that should be hidden entirely — not offered to users for new connections and not injectable into Gadgets. |
disabledResources | Record<string, string[]> | Per-vendor map of URL patterns for resources that should not be offered. For example, disabling a specific GitHub org pattern. |
ambientGatekeeperModes | Record<string, AmbientGatekeeperMode> | Per-vendor provisioning mode for auto-provisioning gatekeepers (e.g. the Context Library): "disabled" / "optional" (default) / "enabled" (force-provisioned for all users). |
formats | FormatCuration[] | Ordered list of promoted blueprint IDs offered as standard output formats in the New menu and recommended by the agent. Each entry can carry an agentHint (one line telling the agent when to prefer it) and display overrides (custom noun, plural, and icon). |
Wrangler bindings
Beyond environment variables, the backend expects several named bindings inwrangler.jsonc. These are configured automatically by the deploy wizard; when deploying manually you’ll need to declare them.
| Binding | Type | Purpose |
|---|---|---|
BLUEPRINTS | KV Namespace | Stores blueprint metadata and the mirrored AdminConfig (under the reserved key .adminConfig). Hot-path reads use a single cheap KV get. |
BLUEPRINT_CONTENT | R2 Bucket | Stores the full content of blueprint archives (.gadget files). Separate from metadata to keep KV values small. |
GATEKEEPER_<NAME> | Service Binding | One binding per installed gatekeeper Worker, e.g. GATEKEEPER_GITHUB, GATEKEEPER_GOOGLE. The router discovers installed gatekeepers by scanning its own GATEKEEPER_* bindings. Adding a gatekeeper is purely a binding change — no backend code changes are needed. |