Integration · Cloudflare

Connect Cloudflare to Kroy.

When Kroy Publish publishes approved content, rebuild your Cloudflare-hosted site through a deploy hook — without giving any AI access to your hosting.

Available
Connect Cloudflare to Kroy

Cloudflare + Kroy

Connect Cloudflare once. Use it safely with any AI.

  1. Cloudflare, where it already is.

    Cloudflare stays the authoritative record. Nothing moves, and nothing is copied that doesn’t need to be.

  2. Cloudflare connects to Kroy.

    A deploy hook URL and, optionally, a scoped Cloudflare API token, both held by Kroy. Kroy holds the connection.

  3. Your AI connects to Kroy.

    Claude, ChatGPT or another AI connects to Kroy — not to Cloudflare. It never receives Cloudflare credentials.

  4. Exactly what is allowed.

    Each Cloudflare action is a Kroy capability; trigger site rebuild waits for a person by default. Kroy triggers builds; it does not host your site or edit your site’s code.

  5. A real request.

    Claude asks for read deployment status. Kroy checks the person, the agent and the policy, calls Cloudflare, and records the request.

Cloudflare
Kroy
Claude
Priya Client manager
AUDIT

Cloudflare capabilities

  • ✓cloudflare.deployments.read
  • !cloudflare.deploy_hook.trigger
  • ✕Kroy triggers builds; it does not hos…
Cloudflare
Kroy
Claude
Priya Client manager
AUDIT

Cloudflare capabilities

  • ✓cloudflare.deployments.read
  • !cloudflare.deploy_hook.trigger
  • ✕Kroy triggers builds; it does not hos…

Supported resources

  • Deploy hooks for Cloudflare-hosted sites, such as Cloudflare Pages projects
  • Deployment status (read, with an API token)
  • Cache for the site’s zone (with an API token)

Authentication

A deploy hook URL and, optionally, a scoped Cloudflare API token, both held by Kroy. AI clients never receive the hook URL or the token.

Supported actions

CapabilityTypeDefault
cloudflare.deployments.read
Read deployment status		readPolicy
cloudflare.deploy_hook.trigger
Trigger site rebuild		writeHuman approval
cloudflare.cache.purge
Purge cached pages		writeHuman approval

Events

cloudflare.deployment.succeededcloudflare.deployment.failed

Overview

Kroy Publish manages the content; your frontend renders it; your host serves it. Cloudflare is one of the places sites built with Astro, Next.js and similar frameworks are commonly hosted.

The Kroy Cloudflare connector closes the loop. When a person approves a change and Kroy publishes it to a Channel, Kroy calls the site’s deploy hook and the site rebuilds with the new projection. Nobody — and no AI — needs a Cloudflare login to update the website.

How publishing reaches the site

  1. Claude drafts a change as an Artifact in Kroy.
  2. A person reviews and approves it.
  3. Kroy publishes the approved content to the website Channel.
  4. Kroy triggers the Cloudflare deploy hook.
  5. Kroy records the deployment result.

The approval in step 2 covers the rebuild in step 4. Triggering a rebuild outside a publication — for example an AI asking for one directly — requires its own approval by default.

Permissions

Each Cloudflare action is a Kroy capability. Kroy decides every request against the person, the agent, the delegation, the policy and any approval. Purging the cache requires approval by default.

Security

A deploy hook URL is effectively a secret: anyone holding it can start a build. Kroy holds it, along with any API token, and exposes neither to AI clients. Use an API token scoped to the single project or zone involved. Every trigger, result and refusal is recorded.

Limitations

  • Kroy triggers builds; it does not host your site or edit your site’s code.
  • DNS, security settings, firewall rules and account settings cannot be changed through Kroy.
  • Deployment status and cache purge need an API token with the relevant scope. A deploy hook alone can only start a build.
  • Build success depends on your site’s own build configuration.