cloudflare-temporary-deploy

name	cloudflare-temporary-deploy
description	Deploys a Cloudflare Worker to a live workers.dev URL with wrangler deploy --temporary (Wrangler 4.102.0+), a 60-minute claim URL, and no OAuth. Use when shipping agent-written Worker code to a link without an account, or iterating a throwaway prototype. Not for production or CI with wrangler login / CLOUDFLARE_API_TOKEN, Cloudflare Pages/R2, or hosting that must outlive an unclaimed hour.
version	1.0.1
author	Hermes Agent
license	MIT
platforms	["linux","macos","windows"]
metadata	{"hermes":{"tags":["cloudflare","workers","wrangler","deploy","temporary","agent","serverless","web-development"],"category":"web-development"}}

Cloudflare Temporary Deploy

Deploy a Cloudflare Worker to a live workers.dev URL with zero account setup, using wrangler deploy --temporary. Cloudflare provisions a throwaway account, deploys, and prints a claim URL valid for 60 minutes; unclaimed accounts auto-delete. This gives an agent a tight write → deploy → verify loop without any OAuth, signup, or token copy-paste.

This skill does NOT cover production deploys (use wrangler login + a permanent account for those), nor non-Worker Cloudflare products beyond the temporary-account limits listed below.

When to Use

Load this skill when the user wants to:

• Ship agent-written code to a live URL without first creating a Cloudflare account — "deploy this and give me a link"
• Iterate in a background/autonomous session where a browser OAuth step would be a hard stop
• Prototype or evaluate Workers quickly with a throwaway, claimable target
• Build a self-verifying deploy loop — deploy, curl the live URL, confirm output matches the code, redeploy

When NOT to Use

• Production or CI/CD → use a permanent account (wrangler login or CLOUDFLARE_API_TOKEN). --temporary errors out if any credential is present.
• Wrangler is already authenticated → --temporary returns an error by design. Run wrangler logout first only if the user explicitly wants a throwaway deploy.
• Long-lived hosting → temporary deployments are deleted after 60 minutes unless claimed.

Prerequisites

• Wrangler 4.102.0 or later. This is the version that introduced --temporary. Earlier versions do not have it. Verify with npx wrangler@latest --version.
• Node 18+ / npm (or npx, yarn, pnpm). No global install needed — npx wrangler@latest works.
• No Cloudflare credentials present. --temporary only works when Wrangler is unauthenticated: no OAuth login, no CLOUDFLARE_API_TOKEN / CLOUDFLARE_API_KEY env var, no ~/.wrangler / ~/.config/.wrangler cached OAuth. Use the terminal tool's environment as-is; do not set those vars.
• Network egress to cloudflare.com and workers.dev.
• Using --temporary accepts Cloudflare's Terms of Service and Privacy Policy.

Windows / PowerShell Notes

Windows is the primary host. All commands below are PowerShell-compatible unless noted. Key differences:

• Pipe to the parser: use 2>&1 the same way — PowerShell supports it natively.
• curl on Windows is curl.exe (the real curl, not a PowerShell alias). If curl resolves to Invoke-WebRequest, use curl.exe -sS <url> explicitly.
• Paths use backslashes on Windows: scripts\parse_deploy_output.py. The parser script is invoked via python (not python3) on Windows if python3 is not on PATH. Try python3 first, fall back to python.
• The skill directory on the reference machine is ~\agent-skills\library\cloudflare-temporary-deploy\.

Procedure

Use the terminal tool for every step. Always pin the version (wrangler@latest or wrangler@4.102.0 or newer) so you don't accidentally run an old global wrangler that lacks the flag.

1. Verify Wrangler version

npx wrangler@latest --version

Confirm the output is 4.102.0 or higher. If it is older, npx wrangler@latest will fetch the newest version automatically.

2. Scaffold a minimal Worker (skip if the project already exists)

A Worker needs a wrangler.toml (or wrangler.jsonc) and an entry script. Write these with write_file:

wrangler.jsonc:

{
  "name": "hello-agent",
  "main": "src/index.ts",
  "compatibility_date": "2025-01-01"
}

src/index.ts:

export default {
  async fetch(): Promise<Response> {
    return new Response("hello cloudflare");
  },
};

3. Deploy with --temporary

From the project directory:

npx wrangler@latest deploy --temporary

The proof-of-work check adds a short automatic delay. On success Wrangler prints:

• An Account: <name> (created) (or (reused)) line
• A Claim URL
• The live https://<worker>.<account>.workers.dev URL

4. Parse the URLs

Run the helper to extract them reliably instead of eyeballing the output. Load scripts/parse_deploy_output.py from this skill's directory (~\agent-skills\library\cloudflare-temporary-deploy\scripts\parse_deploy_output.py):

npx wrangler@latest deploy --temporary 2>&1 | python3 scripts/parse_deploy_output.py

On Windows, if python3 is not on PATH, substitute python:

npx wrangler@latest deploy --temporary 2>&1 | python scripts/parse_deploy_output.py

The parser prints JSON:

{"live_url": "...", "claim_url": "...", "account": "...", "account_state": "created|reused", "expires_minutes": 60, "deployed": true}

5. Verify the deploy is live

Do not trust the deploy log alone. curl the live URL and confirm the body matches what the code returns:

curl.exe -sS <live_url>

6. Iterate

Edit the code, redeploy with the same command:

npx wrangler@latest deploy --temporary

Within the 60-minute window Wrangler reuses the cached temporary account (Account: <name> (reused)), so the URL stays stable. curl again to confirm the change.

7. Hand the claim URL to the user

Tell them: open it within 60 minutes to keep the deployment and any resources; if they don't claim it, everything auto-deletes. Treat the claim URL as a secret — it grants ownership of the account. Do not log it into shared transcripts as "just a link."

Quick Reference

Step	Command
Check version (need 4.102.0+)	npx wrangler@latest --version
Deploy (no account)	npx wrangler@latest deploy --temporary
Deploy + parse URLs	npx wrangler@latest deploy --temporary 2>&1 | python3 scripts/parse_deploy_output.py
Verify live	curl.exe -sS <live_url>
Clear cached temp account	npx wrangler@latest logout

Temporary Account Product Limits

Product	Limit on a temporary account
Workers	Deploys to workers.dev
Static Assets	Up to 1,000 files, 5 MiB each
KV	Allowed
D1	1 database, 100 MB per DB / 100 MB total
Durable Objects	Allowed
Hyperdrive	2 configs, 10 connections
Queues	Up to 10
SSL/TLS certs	Allowed

Pitfalls

• --temporary is not in wrangler deploy --help and is not a global flag. It is intentionally hidden and surfaced dynamically: when an unauthenticated wrangler deploy fails, Wrangler prints "rerun with --temporary". Don't conclude the flag is missing just because --help omits it — check the version instead.
• Old global wrangler. A stale globally-installed wrangler (< 4.102.0) silently lacks the flag. Always invoke npx wrangler@latest (or a pinned >=4.102.0) so you control the version.
• Auth present → hard error. If wrangler login was ever run, or CLOUDFLARE_API_TOKEN/CLOUDFLARE_API_KEY is set, --temporary errors. Either unset the var for this shell or wrangler logout. Never strip a user's real credentials without telling them.
• Rate limiting. Creating temporary accounts too fast fails. Reuse the cached account (just redeploy) within the 60-minute window instead of forcing a new one; if rate-limited, wait or use a permanent account.
• 60-minute hard expiry, not extendable. If the deploy must outlive an hour, the user must claim it. Surface this clearly.
• curl may briefly serve the old body after a redeploy. workers.dev has a short edge cache; the (reused) line plus a new Current Version ID confirm the deploy succeeded even if curl shows stale content for a few seconds. Re-curl, or add a cache-busting query string (?v=2), before concluding a redeploy failed.
• Don't log the claim URL into shared transcripts as "just a link." It is credential-equivalent — anyone with the claim URL owns the account.
• Windows curl alias. On Windows PowerShell, curl may alias to Invoke-WebRequest. Always use curl.exe to ensure you get the real curl with -sS support.
• python3 vs python on Windows. If python3 is not found, fall back to python. The parser script works with both.

Verification

Run these checks to confirm the skill executed correctly:

1. Version check:

   npx wrangler@latest --version
   

   Output must be >= 4.102.0.

2. Deploy output check:

   npx wrangler@latest deploy --temporary
   

   Output must include a workers.dev live URL and a claim-preview?claimToken= claim URL.

3. Live URL check:

   curl.exe -sS <live_url>
   

   Body must match exactly what the Worker code returns (e.g., hello cloudflare).

4. Reuse check (second deploy):

   npx wrangler@latest deploy --temporary
   

   Output must report Account: <name> (reused) and the live URL must be unchanged.

5. Parser self-test:

   python3 scripts/parse_deploy_output.py --selftest
   

   (Or python scripts/parse_deploy_output.py --selftest on Windows if python3 is unavailable.) Must exit with code 0 and report all assertions passing.

Related Skills

• cloudflare-workers-deploy — permanent account deploy via wrangler login or CLOUDFLARE_API_TOKEN for production/CI.
• cloudflare-workers-dev — local dev server with wrangler dev for pre-deploy testing.