Cloudflare OS deployment architecture
Users reach the deployment through one public route, owned by the Router Worker. The Router serves the Workshop frontend, sends /api to the Workshop backend, and sends /gatekeeper/<name> to whichever Gatekeeper the binding name matches. Behind it is the pinned Cloudflare OS release, containing the Workshop kernel, Gadgets, Blueprints, and the default Gatekeepers including Context. Service bindings connect that to the Workers and resources this repository owns and deploys: AI Gateway, enabled by default and needing no API token, any number of custom Gatekeepers, the Error Reporter, and KV and R2 storage.
Users
Access, password, or OAuth
PUBLIC ORIGIN
Router
The only public route
/api → Workshop backend
/gatekeeper/* → Gatekeepers
Everything else → frontend
Cloudflare OS
Pinned upstream release
Workshop kernel
Overseer, policy, and RPC
Gadgets
Sandboxed Durable Objects
Blueprints
Shareable Gadget templates
Default Gatekeepers
Context and the rest of the set
Your deployment
Workers and resources you own
THIS REPO
AI Gateway
Workers AI models, no API token
DEFAULT ON
Custom Gatekeepers
Your organization's APIs
Error Reporter
Workers Logs or your collector
KV + R2
Provisioned in your account