Web installer

Install in your Cloudflare

A guided wizard that creates the Worker and D1 database for you. Connect with one click (OAuth) or paste an API token — everything else is automatic.

1Start

2Connect Cloudflare

3Review plan

4Deploy & snippet

Welcome

The installer lives on your machine and only talks to Cloudflare. Nothing else is involved.

No account, no email — ready to connect your Cloudflare account.

Connect Cloudflare

Both methods need a one-time permission from you — after that everything is automatic. Pick whichever you prefer.

Which one?

Fastest nowInstalling once → paste an API token (fewest steps, no registration).

Best repeatInstalling often → OAuth (one click per install, after a one-time setup).

Option A — Connect with Cloudflareone click after setup

Authorize in your browser with the minimal scopes (Workers deploy, D1, account read). The token is revoked right after the deploy.

How to enable this option (one-time setup)

In the Cloudflare dashboard go to Manage Account → OAuth clients → Create client.
Fill in: response type code, grant authorization_code, token auth client_secret_post, redirect http://localhost:8788/oauth/callback.
Scopes: workers-platform.write, d1.write, account.read.
Put CLIENT_ID and CLIENT_SECRET in apps/installer/.env.local and restart the installer.
From now on every install is one click: Connect → Approve → done.

Option B — Paste an API tokenfastest for one-time

Create a token with 3 permissions and paste it here. Open API tokens ↗

How to create the token (about 1 minute)

Open API tokens ↗ → Create Token → Custom token.
Add these 3 account permissions:
Workers Scripts → Edit — deploys the Worker.
Cloudflare D1 → Edit — creates and manages the database.
Account Settings → Read — lists your accounts.
Create → copy the token → paste it above. It is validated instantly, kept only in memory, and cleared after the deploy.

Comment data never touches our servers. With OAuth the token is revoked after the deploy; with a pasted token it lives only in memory here and is cleared after the deploy.

Review the plan

The engine compares your account with the desired state and plans only the missing actions. Nothing happens until you confirm.

Cloudflare account Worker name D1 database name Rate limit namespace ID (optional)

Admin sign-in — recommended

Cloudflare Access team (recommended — enables "Sign in with Cloudflare" in your admin, no password to remember) Access application AUID (optional — hardens the login)

How it works: protect /admin.html with a Cloudflare Access app (Zero Trust) in your account, then add the team name here. Cloudflare verifies who you are — StaticLayer never sees your Cloudflare password. The admin password is still shown once as a fallback.

GitHub sign-in — free & password-less

GitHub OAuth App Client ID (optional — enables "Sign in with GitHub"; no credit card, no Zero Trust plan) GitHub OAuth App Client Secret (stored as a Worker secret) Your GitHub user id (allowlist — find it at api.github.com/users/<your-login> → "id")

Create a free OAuth App on GitHub (Settings → Developer settings → OAuth Apps) with the Authorization callback URL <your-worker>/api/admin/github/callback, then paste the Client ID / Secret and your numeric user id here. GitHub only ever sees your own login — no visitor data ever leaves your Worker. The full step-by-step guide lives in the admin console → Settings → Admin access & sign-in.

Your site — recommended

Your site URL (recommended — lets the widget call this Worker from your site)

Pick one of your Cloudflare domains (if the token allows it) or type the URL — we'll pre-configure ALLOWED_ORIGINS (CORS) so the widget works out of the box. Multiple sites? Add them later in the Worker's Variables.

✓

Deploy successful

Your Worker and database are live in your Cloudflare account.

Your admin console

Open this URL, then paste the admin password below:

Open admin ↗

Your admin password

This is the only time it is shown. Save it now — you need it to open /admin.html and moderate your comments.

Snippet for your page

Connect the Worker to your domain with Workers Routes in the dashboard, or use the CLI: npx staticlayer init.