Cloudflare CLI (

cf

)

cf

cf cli search

cf schema

--help

--dry-run

Documentation

cf init

cf dev

cf deploy

cf

cf migrate

cf

cloudflare.config.ts

cf

FIRST: check installation and sign in

npm install --global cf   # installs two equivalent commands: `cf` and `cloudflare`
cf --version
cf auth whoami

• Requires Node.js 22.18 or later. Bun is not supported.
• If another tool named

  cf

  is on your

  PATH

  , use

  cloudflare

  instead — the package installs both commands.

• cf auth login

  prints a link and a one-time code, then opens the browser. On a remote machine, over SSH, or in a container, add

  --no-browser

  so

  cf

  only prints the link; approve it from another device. Add

  --force

  to sign in again.

• cf

  keeps its own credentials and does not reuse a Wrangler login.
• Unattended agents and CI cannot complete

  cf auth login

  — set

  CLOUDFLARE_API_TOKEN

  instead (see https://developers.cloudflare.com/cf/ci/index.md).

cf

AGENTS.md

CLAUDE.md

When interacting with Cloudflare, use the `cf` CLI unless the project has a
Wrangler configuration file.

Find commands

cf cli search "create a DNS record"   # local, no credentials; quote the whole task; up to 5 JSON matches
cf schema d1 create                   # API request shape: method, path, params, body fields
cf <command> --help                   # arguments and options (e.g. cf deploy --help)

cf cli search

cf schema

--help

Read output

• Results are JSON on standard output; status messages and errors go to standard error, so piping to

  jq

  or redirecting needs no extra flags.
• Lists print one JSON array page; paging options differ per command — check

  --help

  .
• A failed command exits non-zero and prints the error to standard error.

Run commands safely

• Preview first.

  --dry-run

  prints the request as JSON without sending it, and needs no credentials.
• Aborted deletes still exit 0. In a non-interactive session, a destructive command without

  --force

  prints

  Aborted.

  to standard error and exits

  0

  — a zero exit does not mean the resource was deleted.
• Review

  --force

  before allowing it. On some commands

  --force

  is also an API parameter (for example,

  cf workers delete --force

  also deletes a Worker that other Workers reference).

• --local

  is limited. It works for KV keys, D1 databases (

  cf d1 raw

  ,

  cf d1 migrations list|apply

  ), and R2 objects; other commands (including

  cf d1 query

  ) return an error instead of calling the API.

Choose the CLI for this project

• cloudflare.config.ts

  exists: use

  cf

  .

• wrangler.jsonc

  ,

  wrangler.json

  , or

  wrangler.toml

  exists, and no

  cloudflare.config.ts

  : keep Wrangler for

  dev

  ,

  build

  , and

  deploy

  . Do not run

  cf dev

  ,

  cf build

  , or

  cf deploy

  there — they can generate a new configuration that ignores the Wrangler file, or fail.

  cf

  resource commands (DNS, zones, storage) are fine alongside it. Run

  cf migrate

  only when the user asks, and follow Migrate a Wrangler project: preview with

  cf migrate --dry-run

  , run

  cf migrate

  , then resolve the

  TODO(@cloudflare)

  comments in the generated

  cloudflare.config.ts

  .
• Neither exists: use

  cf

  , as Use cf with coding agents recommends. Do not install Wrangler or create a Wrangler configuration file.

cf cli search

cf

Commands

cf

does not support yet

cf

npx wrangler

cloudflare.config.ts

• Live logs:

  npx wrangler tail <WORKER_NAME>

  .
• A single secret:

  npx wrangler secret put <SECRET_NAME> --name <WORKER_NAME>

  . Or upload secrets with a new Worker version by passing

  --secrets-file <PATH>

  to

  cf deploy

  or

  cf workers versions create

  .