Deploying Cloudflare OS: From Account Setup to Employee Login

Published: Last updated:

Edited by:

Key point: A company AI system requires more than a chat subscription. You must decide who can sign in, which internal data the AI may read, and which actions require human approval. This guide takes you through deploying Cloudflare OS to your Cloudflare account and limiting login access to selected employees. It does not connect internal data yet.

This guide covers Cloudflare OS v2 as of August 2026. The product is officially in Early Access and remains under development. Production adoption requires change review before updates and deliberate authorization design. Always check the latest details in the official starter documentation.

Do Not Roll It Out Company-Wide at First

There is no need to launch company-wide immediately. The following sequence balances security with practical adoption.

  1. Run it with one person and verify the features
  2. Then restrict which employees can sign in
  3. Finally, add internal data and permitted actions one at a time

This guide covers steps one and two. Step three is covered in the Gatekeeper Guide.

Three Ways to Start

Method 1: Run It Locally on Your Computer

To review the product quickly, clone the official repository, install pnpm, and run the following command. 

pnpm run-local

After it starts, open http://localhost:8787 in a browser. This runs the complete Cloudflare OS locally with Wrangler and the Cloudflare Workers local runtime, workerd.

The official documentation explicitly states that this is not for production use. Use it only to review features before connecting internal data.

Method 2: Use the Official Hosted Deployment

Use the official deployment page. This is a fast way to get a working deployment, but for internal production use we recommend method three so your company owns the entry point and administrative responsibility.

Method 3: Deploy the Official Starter to Your Account (Recommended)

Use cloudflare-os-starter as the basis for a deployment to your Cloudflare account. The rest of this guide assumes this method.

Prerequisites

The official README lists the following prerequisites.

  • Cloudflare account
  • Node.js 24
  • pnpm 11
  • Wrangler
  • Cloudflare Workers
  • KV / R2
  • Browser Rendering
  • Dynamic Worker Loaders

Workers AI, AI Gateway, and Artifacts are optional. You can deploy Cloudflare OS without enabling AI and configure the model later. You do not need to settle model selection first; verify login, storage, authorization, and monitoring foundations before adding AI.

See the Pricing and Cost Guide for cost considerations.

Deployment Steps

1. Get the Starter and Install Required Packages

After cloning the repository, prepare the submodules and dependencies, including Cloudflare OS itself. 

git submodule update --init
pnpm install
pnpm --dir cloudflare-os install
pnpm exec wrangler login

The final command opens a browser and connects Wrangler to the Cloudflare account you will use.

2. Protect the Employee Entry Point with Cloudflare Access

Do not expose Cloudflare OS to the internet without access controls. In the standard starter configuration, Cloudflare Access verifies identity before a request reaches Cloudflare OS.

  1. Choose a dedicated domain such as os.example.com
  2. Create a Cloudflare Access Self-hosted application for that domain
  3. Configure the email addresses or company domains allowed to sign in
  4. Get the Access Application Audience Tag
  5. Add the domain, Audience Tag, and administrator email to deployment.jsonc

You can use workers.dev for testing before adopting a custom domain. For internal production use, a custom domain and Access make ownership and administrative responsibility clearer.

3. Add Company Settings to deployment.jsonc

Configure the following primary settings.

  • Cloudflare Account ID
  • Names for each Worker
  • Hostname for Cloudflare OS
  • Access Audience Tag
  • Administrator email address
  • KV and R2 storage locations
  • Whether to enable AI features
  • Whether to enable Context and a custom Gatekeeper

If KV or R2 values remain null, Wrangler automatically creates the three required KV namespaces and an R2 bucket. Specify IDs or bucket names when using existing storage.

Do not put passwords or API keys directly in configuration files. The official starter is designed to keep secrets out of Git-managed configuration. Register credentials as Worker secrets.

4. Validate Configuration Before Deployment

After configuration, validate it before deploying to production. 

pnpm check
pnpm deploy

pnpm check checks for configuration errors. If it passes, pnpm deploy deploys the required Workers in order. It first creates supporting components such as Gatekeeper and Error Reporter, then deploys the Cloudflare OS application used by employees.

5. Apply Company Settings in /admin

After deployment, open the Cloudflare OS URL, verify that Access login works, and then open /admin. You can change the following without redeploying code.

  • Company name and logo
  • Accent color
  • Employee announcements
  • Organization-wide AI rules
  • The initial Blueprint to promote
  • Available connectors
  • Whether Context and a custom Gatekeeper are available

You do not need to enable every feature at first. Limiting the initial scope to one employee workflow makes usage and issues easier to observe.

Completion Checklist

The official starter recommends the following post-deployment checks.

  • Only intended employees can sign in through Access
  • The administrator email is recognized correctly
  • Unneeded Context and Gatekeeper features are disabled
  • Error Reporter and each Worker log are available
  • Company name, logo, and shared AI instructions can be changed from /admin

The deployment is complete once these checks pass. At this stage, you do not need to connect internal data or grant the AI write access.

Next Steps

Next, place Gatekeeper between the AI and systems such as GitHub, Google Drive, CRM, and internal databases. Gatekeeper acts as a front desk for the AI, handling OAuth authentication, authorization limits, action logs, and human approval.

Instead of giving the AI an API key, design who can perform which actions on which data for each workflow. See the Gatekeeper Guide.

Technical deployment alone does not guarantee business value. The organizational process from workflow selection through a PoC and departmental rollout is covered in Six Steps for Adoption.

Sources

Related Guides

What Is Gatekeeper? Learn how Gatekeeper connects AI to internal data safely and how to plan integrations. Six Steps for Organizational Adoption Follow the organizational process from workflow selection through departmental rollout. Pricing and Cost Breakdown Understand what a $0 license means and which operating costs still apply. How Cloudflare Uses It Internally Review published usage results and the five-stage company-wide rollout.

We can support deployment, initial configuration, hands-on enablement, and Access design.

Discuss Your Adoption