Cloudflare Permissions & Scopes
Nodes2Cloud executes entirely on your own Cloudflare infrastructure. We request the absolute minimum scoped permissions required to compile and maintain your edge workers.
Required API Permissions
| Scope Area | Permission | Access Level | Why It's Needed |
|---|---|---|---|
| Account | Account Settings | Read | Validates your Cloudflare Account ID and identifies available subscription capabilities. |
| Account | Workers Scripts | Edit | Compiles, bundles, and deploys your visual workflow graphs directly to Cloudflare Workers. |
| Account | Workers KV Storage | Edit | Provisions dedicated KV namespaces for persisting step run state and workflow logs. |
How to Create a Scoped Token in Cloudflare
If you prefer using an API Token over 1-click OAuth, follow these steps in your Cloudflare dashboard:
- Log into the Cloudflare API Tokens Dashboard.
- Click Create Token, then scroll to Custom Token and click Get started.
- Name the token
Nodes2Cloud Deployment Token. - Under Permissions, select:
- Account | Workers Scripts | Edit
- Account | Workers KV Storage | Edit
- Account | Account Settings | Read
- Under Account Resources, choose Include → Specific account → [Your Cloudflare Account].
- Click Continue to summary, verify the permissions, and click Create Token.
- Copy the token string and paste it into Nodes2Cloud under Integrations → Cloudflare.
Subrequest Quotas & Workers Limits
Cloudflare Workers limits the number of outgoing HTTP subrequests (fetch calls, external API calls, and KV queries) that a single execution can invoke:
Workers Free Plan
50
Subrequests max per invocation. Nodes2Cloud compiler automatically warns you if loops could exceed 50 calls.
Workers Paid Plan ($5/mo)
1,000
Subrequests max per invocation. Ample budget for large batch syncs, multi-model AI workflows, and pagination loops.
Automated Token Preflight & Re-Verification
To prevent broken deployments, Nodes2Cloud runs automated preflight checks against your token before every deploy. You can also manually click Re-verify on the Cloudflare card in your Integrations dashboard at any time.
The probe verifies four key checks:
- Token is active and not expired (via
/user/tokens/verify). - Account ID exists and is accessible by the token.
- Workers Scripts upload permission is granted.
- Workers KV namespace creation and read/write permission is functional.