Cloudflare Workers

Deploy your Restate services on Cloudflare Workers. This guide covers project configuration, service registration, and security setup.

Follow the quickstart to try Cloudflare Workers and Restate locally.

Deploying to Cloudflare Workers

Set up your project

New project
Existing Cloudflare Workers project

Start with the cloudflare-workers-template and follow its README.

Create your Restate + CloudFlare workers repository

Import the Restate SDK with the fetch component:

import * as restate from "@restatedev/restate-sdk-cloudflare-workers/fetch";

// Export the Restate handler
export default {
    fetch: restate.createEndpointHandler({ services: [greeter] })
};

Make sure your wrangler.toml sets the nodejs_compat flag and enables preview urls:

# The name of your Cloudflare Worker project
name = "restate-cloudflare-worker"

# Entrypoint
main = "./src/index.ts"

# Preview URLs are used to register to Restate
preview_urls = true

# Enable NodeJS compatibility (used by the SDK for the Node Buffer API)
# and Node's process.env (for logging)
compatibility_date = "2026-02-20"
compatibility_flags = [ "nodejs_compat" ]

Develop locally

A Workers dev server can be started on port 9080 using:

npm install
npx wrangler dev --port 9080

npx @restatedev/restate deployments register --use-http1.1 http://localhost:9080

wrangler only supports HTTP/1.1 when running locally, so the --use-http1.1 flag is required. This flag is not needed when deploying to Cloudflare Workers.

Secure your service with request identity validation

Cloudflare Workers are public HTTP endpoints. Secure your service with request identity validation so that it only accepts requests from the Restate environment you trust.

Restate Cloud / BYOC
Restate OSS

Restate Cloud and BYOC environments create and manage the request identity key for you.Copy the environment’s public key from Developers > Security > HTTP endpoints in the Restate Cloud UI.

Request identity uses an ED25519 key pair. Give the private key to Restate so it can sign requests, and give the public key to your services so they can verify those signatures.Choose one of the following ways to generate the keys:

Option 1: Let Restate output the public key

Generate the private key:

openssl genpkey -algorithm ed25519 -outform pem -out private.pem

Provide its path to Restate on startup:

export RESTATE_REQUEST_IDENTITY_PRIVATE_KEY_PEM_FILE=private.pem

Start Restate and copy the corresponding public key from the startup log. Restate prints it in the compact format expected by the SDK:

INFO restate_service_client::request_identity::v1
Loaded request identity key
kid: "publickeyv1_w7YHemBctH5Ck2nQRQ47iBBqhNHy4FV7t2Usbye2A6f"
path: private.pem

Option 2: Generate both key files beforehand

Run this script to generate private.pem and write the corresponding publickeyv1_... value to a public-key file before starting Restate:

macOS
Linux

Install OpenSSL 3 with Homebrew, then run the script:

brew install openssl@3

generate.sh

#!/usr/bin/env bash
set -euo pipefail

openssl_bin="$(brew --prefix openssl@3)/bin/openssl"

# generate private key
"$openssl_bin" genpkey -algorithm ed25519 -outform pem -out private.pem
echo "Wrote private key to private.pem"

# encode public key
encoded=$("$openssl_bin" pkey -in private.pem -pubout -outform DER 2>/dev/null |
tail -c +13 |
od -An -v -tu1 |
awk '
BEGIN {
  alphabet = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
  leading = 1
}
{
  for (i = 1; i <= NF; i++) {
    byte = $i
    if (leading && byte == 0) {
      zeroes++
      continue
    }
    leading = 0
    carry = byte
    for (j = 0; j < digit_count; j++) {
      carry += digits[j] * 256
      digits[j] = carry % 58
      carry = int(carry / 58)
    }
    while (carry > 0) {
      digits[digit_count++] = carry % 58
      carry = int(carry / 58)
    }
  }
}
END {
  for (i = 0; i < zeroes; i++) printf "1"
  for (i = digit_count - 1; i >= 0; i--) {
    printf "%s", substr(alphabet, digits[i] + 1, 1)
  }
}')

echo -n "publickeyv1_${encoded}" > public-key
echo "Wrote publickeyv1_${encoded} to public-key"

This script requires Bash, OpenSSL, awk, and GNU Coreutils:

generate.sh

#!/usr/bin/env bash
set -euo pipefail

# generate private key
openssl genpkey -algorithm ed25519 -outform pem -out private.pem
echo "Wrote private key to private.pem"

base58_chars="123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
# encode public key
encoded=$(openssl ec -in private.pem -inform pem -pubout -outform der -out /dev/stdout 2>/dev/null |
tail -c +13 |
basenc --base16 "${1:-/dev/stdin}" -w0 |
if
read
[[ $REPLY =~ ^((00)*)(([[:xdigit:]]{2})*) ]]
echo -n "${BASH_REMATCH[1]//00/1}" # leading 0s -> 1
(( ${#BASH_REMATCH[3]} > 0 ))
then
dc -e "16i0${BASH_REMATCH[3]^^} Ai[58~rd0<x]dsxx+f" | # hex bytes to indexes into the char string
while read -r
do echo -n "${base58_chars:REPLY:1}"
done
fi)

echo -n "publickeyv1_${encoded}" > public-key
echo "Wrote publickeyv1_${encoded} to public-key"

Configure the key in your Restate SDK endpoint before deploying.

const handler = restate.createEndpointHandler({
  services: [myService],
  identityKeys: ["publickeyv1_w7YHemBctH5Ck2nQRQ47iBBqhNHy4FV7t2Usbye2A6f"],
});

The public key is not secret, so it is safe to include it directly in your service source code or configuration files.

Deploy your Worker

Deploy the Worker after configuring request identity validation:

npm install
npx wrangler deploy

Register the service to Restate

After deploying to Cloudflare Workers, use Preview URLs so Restate can target specific service versions. Copy the url of the version, as highlighted here:

Restate Cloud / BYOC
Restate OSS

Or register the service with the CLI:

npx @restatedev/restate deployments register \
  https://<VERSION_PREFIX OR ALIAS>-<WORKER_NAME>.<SUBDOMAIN>.workers.dev

Send your first request

Restate Cloud / BYOC
Restate OSS

You’re set up! Go to the Overview page > Greeter > Playground and start sending requests to your service.

Send {"name": "Alice"} as the request body to the service.

CI/CD Automation

To automatically deploy to Cloudflare Workers on each git commit to main and automatically register new Restate service versions:

If you’ve followed the steps above, then you already have the GitHub Actions workflow set up. All you need to do is to add the secrets below to your project.

Make sure your Cloudflare Worker project exists before the first workflow run. If it does not, create it with npx wrangler deploy.

Restate Cloud / BYOC
Restate OSS

name: Deploy Worker
on:
  push:
    branches:
      - main
jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v5
      - run: npm ci

      - name: Build & Deploy Worker
        uses: cloudflare/wrangler-action@v3
        id: deploy
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: versions upload --message "Deployed via GitHub Actions - commit ${{ github.sha }}"
      - name: Get deployment URL
        id: get-url
        env:
          WRANGLER_OUTPUT: ${{ steps.deploy.outputs.command-output }}
        run: |
          URL=$(echo "$WRANGLER_OUTPUT" | awk '/Version Preview URL:/ {gsub(/.*Version Preview URL: /, ""); print}')
          echo "deployment-url=$URL" >> $GITHUB_OUTPUT

      - name: Register Restate deployment
        env:
          RESTATE_ADMIN_URL: ${{ secrets.RESTATE_ADMIN_URL }}
          RESTATE_AUTH_TOKEN: ${{ secrets.RESTATE_AUTH_TOKEN }}
        run: npx -y @restatedev/restate deployment register -y ${{ steps.get-url.outputs.deployment-url }}

This workflow needs the following GitHub Actions repository secrets:

CLOUDFLARE_ACCOUNT_ID: Your Cloudflare Account. To get your account id, check https://developers.cloudflare.com/workers/ci-cd/external-cicd/github-actions/#cloudflare-account-id
CLOUDFLARE_API_TOKEN: Your Cloudflare API token. To get a token, check https://developers.cloudflare.com/workers/ci-cd/external-cicd/github-actions/
RESTATE_ADMIN_URL: The Admin URL. You can find it in Developers > Admin URL
RESTATE_AUTH_TOKEN: Your Restate Cloud or BYOC auth token. To get one, go to Developers > API Keys > Create API Key, and make sure to select Admin for the role

View

name: Deploy Worker
on:
  push:
    branches:
      - main
jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v5
      - run: npm ci

      - name: Build & Deploy Worker
        uses: cloudflare/wrangler-action@v3
        id: deploy
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: versions upload --message "Deployed via GitHub Actions - commit ${{ github.sha }}"
      - name: Get deployment URL
        id: get-url
        env:
          WRANGLER_OUTPUT: ${{ steps.deploy.outputs.command-output }}
        run: |
          URL=$(echo "$WRANGLER_OUTPUT" | awk '/Version Preview URL:/ {gsub(/.*Version Preview URL: /, ""); print}')
          echo "deployment-url=$URL" >> $GITHUB_OUTPUT

      - name: Register Restate deployment
        env:
          RESTATE_ADMIN_URL: ${{ secrets.RESTATE_ADMIN_URL }}
          RESTATE_AUTH_TOKEN: ${{ secrets.RESTATE_AUTH_TOKEN }}
        run: npx -y @restatedev/restate deployment register -y ${{ steps.get-url.outputs.deployment-url }}

This workflow needs the following GitHub Actions repository secrets:

CLOUDFLARE_ACCOUNT_ID: Your Cloudflare Account. To get your account id, check https://developers.cloudflare.com/workers/ci-cd/external-cicd/github-actions/#cloudflare-account-id
CLOUDFLARE_API_TOKEN: Your Cloudflare API token. To get a token, check https://developers.cloudflare.com/workers/ci-cd/external-cicd/github-actions/
RESTATE_ADMIN_URL: The URL through which GitHub Actions can reach your Restate Admin API
RESTATE_AUTH_TOKEN: Set this token if GitHub Actions reaches the Admin API through a reverse proxy that accepts bearer token authentication

SDKs

Services

Restate Cloud / BYOC / OSS

References

Cloudflare Workers

Deploying to Cloudflare Workers

Set up your project

Secure your service with request identity validation

Deploy your Worker

Register the service to Restate

Send your first request

CI/CD Automation

​Deploying to Cloudflare Workers

Set up your project

Secure your service with request identity validation

Deploy your Worker

Register the service to Restate

Send your first request

​CI/CD Automation

Deploying to Cloudflare Workers

CI/CD Automation