---
name: "Cloudflare"
description: Manage Cloudflare Workers, Pages, R2, D1, KV, and DNS through the official `wrangler` CLI.
version: 1
situations: cloudflare, workers, r2, d1, kv, dns, edge
requires-secrets:
requires-packages:
requires-connector: cloudflare
---

# Cloudflare (`wrangler`)

Runs through Cloudflare's official CLI in your **bash** tool. The operator connected the account from
00's skill store, so the OAuth token is already in wrangler's own config.

## First, know who you are

```
wrangler whoami
```

That prints the account and the scopes the token carries. A missing scope is the usual reason a
command 403s — report the scope rather than retrying. Not logged in? **Skill store → Cloudflare →
Connect**.

## Read

```
wrangler deployments list                       # in a Worker's directory
wrangler tail WORKER_NAME --format pretty       # live logs; stop it when you have what you need
wrangler kv namespace list
wrangler kv key list --binding MY_KV --remote
wrangler r2 bucket list
wrangler d1 list
wrangler d1 execute DB_NAME --remote --command "SELECT count(*) FROM users"
wrangler pages project list
```

`--remote` matters: without it, D1 and KV commands read the LOCAL simulator state, which will happily
give you a confident answer about data that only exists on this machine.

## Write

```
wrangler deploy                                  # deploys the Worker in the current directory
wrangler kv key put --binding MY_KV KEY VALUE --remote
wrangler d1 execute DB_NAME --remote --command "UPDATE …"
wrangler secret put NAME                         # prompts — leave this to the operator
```

`wrangler deploy` puts code in front of real traffic. Name the Worker and the environment, and wait
for a yes.

## Never without being asked in this turn

`wrangler delete`, `wrangler r2 bucket delete`, `wrangler d1 delete`, any destructive SQL against
`--remote`, and DNS record changes. A dropped D1 table has no undo.

## Notes

- Worker commands read `wrangler.jsonc`/`wrangler.toml` from the current directory — `cd` to the
  project first, and say which project you're in.
- For anything wrangler doesn't wrap, prefer asking the operator for a scoped API token in the vault
  over scraping wrangler's stored credentials.