> ## Documentation Index
> Fetch the complete documentation index at: https://confidence.spotify.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare Workers

> Confidence Cloudflare resolver for edge-based feature flag evaluation.

The Confidence Cloudflare resolver enables feature flag evaluation at the edge using Cloudflare Workers. Built on the [Confidence Resolver](https://github.com/spotify/confidence-resolver), a Rust-based resolver, it evaluates flags as close to your users as possible. You can then use the Confidence SDKs to resolve from the Cloudflare resolver, either via service binding or regular calls from clients.

## Features

* **Edge evaluation**: Flag rules evaluate at Cloudflare's edge locations worldwide
* **Ultra-low latency**: Evaluation happens close to users, minimizing latency
* **Rust-based resolver**: High-performance flag evaluation powered by the Confidence Resolver
* **Deployer-driven sync**: Run the deployer to fetch the latest flag rules from Confidence and re-deploy the Worker

## Service binding vs HTTP calls

When integrating with the Cloudflare resolver, you have two options for how your services communicate with it:

**Service binding (recommended)**: Cloudflare's [service bindings](https://developers.cloudflare.com/workers/runtime-apis/bindings/service-bindings/) allow Workers to call other Workers directly within Cloudflare's network. This internal routing bypasses the public internet, resulting in ultra-low latency. Use service bindings when your application runs on Cloudflare Workers.

**HTTP calls**: Standard HTTP requests to the resolver endpoint. This involves normal network routing with typically higher latency. Use this approach when calling from external services or client applications.

For the best performance in Cloudflare-based architectures, configure service bindings between your application Worker and the Confidence resolver Worker.

## Deployment

The Cloudflare resolver is deployed using a Docker-based deployer that handles building and publishing the Worker to your Cloudflare account.

### Prerequisites

* Docker installed
* Cloudflare API token with the following permissions:
  * **Account > Workers Scripts > Edit**
  * **Account > Workers Queues > Edit** (needed for the first deploy)
* Confidence client secret (must be type **BACKEND**)

### Deploy to Cloudflare

On the first deploy, create the required Cloudflare Queue:

```bash theme={null}
CLOUDFLARE_API_TOKEN='your-cloudflare-api-token' npx wrangler queues create flag-logs-queue
```

Then run the [deployer image](https://github.com/spotify/confidence-resolver/pkgs/container/confidence-cloudflare-deployer) with your credentials:

```bash theme={null}
docker run -it \
    -e CLOUDFLARE_API_TOKEN='your-cloudflare-api-token' \
    -e CONFIDENCE_CLIENT_SECRET='your-confidence-client-secret' \
    ghcr.io/spotify/confidence-cloudflare-deployer:latest
```

The deployer automatically detects:

* **Cloudflare account ID** from your API token
* **Resolver state** from Confidence CDN
* **Existing deployment** to avoid unnecessary re-deploys

<Note>
  The deployer does not poll for changes. Each run fetches the current state from Confidence, deploys the Worker if the state has changed, and then exits. To keep the Worker up to date, run the deployer on a schedule (for example, via a cron job) or trigger it when flag rules or targeting changes are made in Confidence.
</Note>

### Optional configuration

| Variable                             | Description                                                |
| ------------------------------------ | ---------------------------------------------------------- |
| `CLOUDFLARE_ACCOUNT_ID`              | Required only if API token has access to multiple accounts |
| `CONFIDENCE_RESOLVER_STATE_URL`      | Custom resolver state URL (overrides CDN)                  |
| `CONFIDENCE_RESOLVER_ALLOWED_ORIGIN` | Configure allowed origins for CORS                         |
| `FORCE_DEPLOY`                       | Force re-deploy regardless of state changes                |
| `NO_DEPLOY`                          | Build only, skip deployment                                |

## Using the resolver with service bindings

This section shows how to call the Confidence resolver from your own Cloudflare Worker using a service binding.

### Set up the project

```bash theme={null}
npm create cloudflare@latest my-worker
cd my-worker
npm install @spotify-confidence/sdk
```

### Configure the service binding

Add a service binding to your `wrangler.json` to connect your Worker to the resolver:

```json theme={null}
{
  "$schema": "node_modules/wrangler/config-schema.json",
  "name": "my-worker",
  "main": "src/index.ts",
  "compatibility_date": "2025-02-04",
  "services": [
    {
      "binding": "ConfidenceBinding",
      "service": "confidence-cloudflare-resolver"
    }
  ]
}
```

### Resolve flags in your Worker

Use the [`@spotify-confidence/sdk`](https://github.com/spotify/confidence-sdk-js) package and route resolve requests through the service binding with `fetchImplementation`:

```typescript theme={null}
import { Confidence } from '@spotify-confidence/sdk';

interface Env {
  CONFIDENCE_CLIENT_SECRET: string;
  ConfidenceBinding: {
    fetch: (request: Request) => Promise<Response>;
  };
}

export default {
  async fetch(request, env, ctx): Promise<Response> {
    const confidence = Confidence.create({
      clientSecret: env.CONFIDENCE_CLIENT_SECRET,
      environment: 'backend',
      fetchImplementation: (req: Request) => env.ConfidenceBinding.fetch(req),
      timeout: 1000,
    });

    const flag = await confidence
      .withContext({ targeting_key: 'user-123' })
      .evaluateFlag('my-flag', {});

    return new Response(JSON.stringify({ flag }), {
      headers: { 'Content-Type': 'application/json' },
    });
  },
} satisfies ExportedHandler<Env>;
```

* **`fetchImplementation`** routes resolve requests through the service binding instead of the public internet.
* **`environment: 'backend'`** is required for server-side usage.
* **`withContext()`** passes your evaluation context for flag targeting.

The Cloudflare resolver also works with the [`@spotify-confidence/openfeature-server-provider`](https://github.com/spotify/confidence-sdk-js/tree/main/packages/openfeature-server-provider), if you prefer using the OpenFeature API.

### Deploy

```bash theme={null}
npx wrangler deploy
```

## Limitations

* **Sticky assignments**: Not currently supported with the Cloudflare resolver. Flags with sticky assignment rules will return "flag not found".

## Resources

<CardGroup cols={2}>
  <Card title="Resolver repository" icon="github" href="https://github.com/spotify/confidence-resolver/tree/main/confidence-cloudflare-resolver">
    Source code and deployment instructions
  </Card>

  <Card title="JavaScript SDK" icon="github" href="https://github.com/spotify/confidence-sdk-js">
    Confidence SDK for JavaScript/TypeScript
  </Card>

  <Card title="Cloudflare Workers docs" icon="cloud" href="https://developers.cloudflare.com/workers/">
    Cloudflare Workers documentation
  </Card>

  <Card title="Context" icon="sliders" href="/docs/sdks/context">
    Configure evaluation context
  </Card>

  <Card title="Apply events" icon="chart-line" href="/docs/sdks/apply-event">
    Understand flag assignment tracking
  </Card>
</CardGroup>