Connect Cloudflare (BYO apps)

Fabricated apps run in your Cloudflare account — not the account that hosts the SFab factory. This guide is for that bring-your-own (BYO) account.

What you get

After you connect a BYO account:

1. New Project → Create from template creates a GitHub repo from the starter.
2. SFab provisions D1, R2, and KV in the BYO account and writes real IDs into the repo's wrangler.jsonc.
3. SFab auto-mints a narrow deploy token into the repo's GitHub Actions secrets (when your management token allows it).
4. A successful Deploy workflow on main ships the Worker; the factory observes deploy status.

Prerequisites

On the BYO Cloudflare account:

1. Enable R2 in the Cloudflare dashboard (Storage & databases → R2). New accounts often need an explicit enable step; until R2 is on, fabrication fails with Please enable R2 through the Cloudflare Dashboard.
2. Ability to create an Account API token (Manage account → Account API tokens — not only Profile → User API Tokens).

1. Create the management token

In the BYO account: Manage account → Account API tokens → Create Token.

Use a custom token (for example named sfab-management) on Entire Account with at least:

Without Account API Tokens Write, create-from-template can still provision resources, but deploy-token auto-mint is skipped and you must paste a deploy token per project (fallback).

Optional (template may use it later): Vectorize Edit.

Keep this token only in SFab Settings. Do not put it in GitHub Actions.

2. Connect it in SFab

1. Open your factory → Settings → Integrations → Cloudflare.
2. Paste the Account API token.
3. Confirm the connected account name / id looks like the BYO account you intended.

The token is encrypted at rest and never shown again. To rotate, create a new token (or update permissions on the existing Account API token), then reconnect.

3. Create a project from template

Use New Project with Create from template and a unique repo name.

Wait until fabrication succeeds. You should see:

• A linked GitHub repo under the project
• Commits that seed the template and inject Cloudflare resource IDs ([skip ci] on those commits is expected)
• Real database_id / bucket names / account_id in apps/web/wrangler.jsonc (not placeholders)

If fabrication fails with an R2 enable error, finish the R2 prerequisite and recreate (or retry) the project.

4. First deploy

Fabrication commits use [skip ci], so CI and Deploy do not run automatically after create.

1. On the fabricated repo, push a normal commit to main (no [skip ci]).
2. Watch Actions: CI green on that push, then Deploy (workflow name must stay Deploy).
3. In SFab, the project's production / deploy surface should move to live once the platform observes a successful Deploy on main.

Deploy needs CLOUDFLARE_API_TOKEN in the repo's Actions secrets — normally written by auto-mint (step 1 permission) or by pasting a scoped deploy token in project settings (Workers Scripts Write + D1 Write).

Troubleshooting

Related

• Installation — factory account (self-host)
• Architecture: template — what every app is fabricated from