> ## Documentation Index
> Fetch the complete documentation index at: https://connect-docs.supertab.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare

> Publish RSL license and deploy CAP enforcement on Cloudflare Workers.

Supertab Connect runs on Cloudflare as a single Worker that both serves your RSL license at `/license.xml` and enforces the Crawler Authentication Protocol (CAP) on all other traffic — everything stays on your domain.

<Note>
  This flow uses the [Wrangler CLI](https://developers.cloudflare.com/workers/wrangler/install-and-update/). Install it and authenticate once before you start:

  ```bash theme={null}
  npx wrangler login
  ```
</Note>

***

## Project Setup

```bash theme={null}
mkdir supertab-worker && cd supertab-worker
npm init -y
npm install @getsupertab/supertab-connect-sdk
```

## Worker

The Worker branches on the request path: `/license.xml` is proxied to the Supertab Connect API (keeping the URL on your domain), and every other request goes through CAP verification.

```typescript theme={null}
// src/index.ts
import { SupertabConnect, Env, EnforcementMode } from "@getsupertab/supertab-connect-sdk";

const MERCHANT_URN = "YOUR_WEBSITE_URN";

async function proxyLicenseXml(): Promise<Response> {
  const upstream = `https://api-connect.supertab.co/merchants/systems/${MERCHANT_URN}/license.xml`;
  const response = await fetch(upstream, { method: "GET", redirect: "manual" });
  return new Response(response.body, {
    status: response.status,
    headers: response.headers,
  });
}

export default {
  async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
    const url = new URL(request.url);

    // Serve the RSL license — handled before the SDK is involved.
    if (url.pathname === "/license.xml") {
      return proxyLicenseXml();
    }

    // Enforce CAP on everything else.
    return SupertabConnect.cloudflareHandleRequests(request, env, ctx, {
      enforcement: EnforcementMode.OBSERVE,
      analyticsEnabled: true,
    });
  },
};
```

Always pass `ctx` — the SDK uses its `waitUntil` to send events in the background without blocking the response: license-usage events whenever a token is verified, plus analytics events when `analyticsEnabled` is set.

<Note>
  If your Worker isn't on your origin's hostname (for example, it proxies to a separate backend), pass an `originUrl` option so the SDK forwards allowed traffic there. Deployments using Workers Routes on your own domain can omit it — `fetch(request)` already resolves to your origin via Cloudflare's edge.
</Note>

## Wrangler Configuration

A single route sends all traffic on your domain to the Worker:

```jsonc theme={null}
// wrangler.jsonc
{
  "name": "supertab-worker",
  "main": "src/index.ts",
  "compatibility_date": "2025-05-21",
  "compatibility_flags": ["nodejs_compat"],
  "routes": [
    { "pattern": "*yourdomain.com/*", "zone_id": "YOUR_ZONE_ID" }
  ]
}
```

The `nodejs_compat` flag is required for the SDK to function. Find your `zone_id` in the Cloudflare dashboard under your domain → **Overview**, in the **API** section.

## API Key Secret

Store your Merchant API key (from the Supertab Connect dashboard) as a Worker secret:

```bash theme={null}
npx wrangler secret put MERCHANT_API_KEY
```

Paste the key when prompted. The SDK reads it automatically from the `env` object at runtime.

## Deploy

```bash theme={null}
npx wrangler deploy
```

Use `wrangler dev` for local preview before deploying to production.

## Enforcement Modes

Set `enforcement` in the handler options:

| Mode                | Behavior                                               |
| ------------------- | ------------------------------------------------------ |
| `DISABLED`          | Skip verification entirely — all requests pass through |
| `OBSERVE` (default) | Verify tokens and record outcomes, but never block     |
| `ENFORCE`           | Block requests with missing or invalid license tokens  |

Start in `OBSERVE` while you validate the integration, then move to `ENFORCE` when you're ready to block.

## Analytics & Bot Classification

Analytics is **off by default**. Pass `analyticsEnabled: true` (shown above) to emit an event for every bot request the Worker sees. Events are sent to Supertab Connect in the background — no additional Cloudflare configuration or log streaming is required.

These events are what power **bot classification** and traffic reporting in your Supertab Connect dashboard. Without `analyticsEnabled: true`, the Worker still enforces CAP, but records nothing — your dashboard shows no bot activity.

## Test

Confirm the license is served — visit `https://yourdomain.com/license.xml`; you should see your RSL license with your domain in the URL bar.

Confirm CAP is enforcing — visit `https://yourdomain.com` in your browser and you should see your normal homepage, unaffected. Then send a request with an invalid token:

```bash theme={null}
curl https://yourdomain.com -H 'Authorization: License not-valid-token'
```

You should get a `401` invalid-token response, confirming CAP is verifying license tokens at the edge.

## Purge Cached License

No action needed. Cloudflare serves the latest `license.xml` immediately after you publish a new version — there is no cache to invalidate. Confirm the update at `https://yourdomain.com/license.xml`.

***

## Related Docs

<CardGroup cols={2}>
  <Card title="Deploy in Your CDN" icon="shield" href="/guides/deploy-cdn">
    CDN-agnostic guide covering RSL serving, CAP enforcement, and robots.txt.
  </Card>

  <Card title="Other CDNs" icon="server" href="/reference/others">
    Generic CDN patterns for platforms not listed above.
  </Card>
</CardGroup>