Controlflare
For Cloudflare Workers · Independent tool

A hard budget cap for Cloudflare.

Set a monthly limit. When your estimated spend crosses it, Controlflare pauses your Workers - before the invoice does the talking. Pause and resume anything yourself from the dashboard.

Set a cap in 2 minutes See how it works

Free during beta, or run it in your own account. Spend is an estimate from Cloudflare usage analytics and published prices - not your invoice.

The problem

Usage-based billing has no brakes.

Workers scale to whatever shows up. That is the point - until something shows up that you did not plan for, and the first you hear of it is the invoice.

A loop that calls itself

A Worker fetches a URL that routes back to the same Worker. Every request spawns another. Nothing errors, so nothing alerts - the request count just climbs.

Traffic you didn't invite

A scraper, a botnet, or a link in the wrong place. Your Worker answers all of it, and you pay per million answers whether or not they were worth giving.

A cron that fires too often

* * * * * when you meant 0 * * * *. Sixty times the work, quietly, for as long as it takes someone to look.

How it works

Three steps, then it watches for you.

  1. Sign in and install the cost agent

    Deploy the open-source cost agent into your own Cloudflare account - one click from the dashboard, Cloudflare's own Deploy button, or wrangler. Create a Cloudflare API token limited to the four permissions it needs and set it on that Worker yourself. It never transits Controlflare, and it is the only way to configure an account.

  2. Set your cap

    Pick a monthly dollar amount for the account. Change it, or switch enforcement off, whenever you like.

  3. We watch usage every 5 minutes

    Controlflare estimates the month's spend across Workers, D1, R2, KV and Durable Object requests from usage analytics. If it crosses your cap, your Workers are paused. Resume with one click when you are ready.

The dashboard

Pause and resume from one place.

Every Worker script in the account, its status, and one button. Pausing removes the ways traffic reaches a script and remembers what it removed, so resume puts everything back.

Pausing a script disables its workers.dev subdomain, detaches custom domains, removes routes, and clears cron triggers. Each of those is saved first, so resuming restores exactly what was there.

What you should know

Estimates, not invoices.

Controlflare is a safety net, and a safety net should be honest about where its edges are.

Spend is estimated

There is no public "current bill" endpoint, so we estimate from Cloudflare's own usage analytics for this calendar month, priced with the published Workers Paid rates. The number covers Workers requests and CPU time, D1, R2, KV and Durable Object requests. It still leaves things out - Durable Object duration above all, which is billed in wall-clock GB-seconds that no public dataset reports, plus Queues, Workers AI and Durable Object storage - so your real invoice can still be higher. If we cannot read a product at all, the dashboard says not included and names the reason; it is never counted as zero.

We never hold your Cloudflare token

Not encrypted, not briefly, not at all - there is nowhere to paste one. Your token needs four permissions and nothing else, and it lives as a secret on the open-source cost agent you deploy into your own Cloudflare account. Controlflare keeps the agent's URL and a pairing secret, signs every request with it, and reads and pauses only through the agent's own allowlist.

You stay in control

Pause or resume any script, or the whole account, whenever you like. Controlflare never resumes anything on its own - when a new month starts, you decide when to switch back on.

Some traffic gets through

Pausing removes the public entry points to a script. Calls from other Workers over service bindings, Durable Object alarms and Queue consumers are not blocked. We say so in the dashboard too.

Deployment

Run it your way.

Your Cloudflare token stays in your own account whichever of these you pick - that is the cost agent's job, not self-hosting's. What changes here is where the rest lives: you keep the data and the dependency. The same code runs in three places.

Hosted

We run it for you

Sign in at the dashboard, install the cost agent, set a cap. Free during beta. Your usage history, caps and pairing secrets live in our D1; your Cloudflare token does not, because we never have it.

Create a free account
Your own Cloudflare account

Deploy the same Worker yourself

Deploy the very same Worker into your Cloudflare account. The D1 database with your usage history, caps and pairing secrets is yours, and so is the cron trigger that enforces them. Single-user instance: signup closes after the first account.

npx wrangler deploy
Self-hosting guide
Kubernetes or Docker

Self-host it anywhere

A Helm chart and a container image. Everything you own is one SQLite file on a persistent volume, and one replica is all it needs - the enforcer is a five-minute poll, not a fleet. Either self-hosted mode means there is no account with us, nothing to sign up for, and no third-party service whose outage stops your cap being enforced.

Self-hosting guide

Every mode configures an account the same way, with the cost agent, and the token it holds is a scoped API token with four permissions - never your Global API Key.

Pricing

Free during beta.

One plan while we finish the rough edges. Paid plans will be announced well before the beta ends, and nothing you set up now will change. Self-hosting is free and open source - that part never changes.

Beta

$0 per month, for now
  • Connect one or more Cloudflare accounts
  • A monthly cap per account, checked every 5 minutes
  • Pause and resume any Worker, or all of them
  • Activity log of every check, pause and resume
Create a free account

No card required. Your Cloudflare bill is between you and Cloudflare; Controlflare charges nothing during beta.

FAQ

Questions, answered plainly.

What gets paused?

Every Worker script in the connected account. For each script, Controlflare:

  • disables the workers.dev subdomain and preview URLs,
  • detaches its custom domains,
  • removes its routes in every zone on the account,
  • clears its cron triggers.

Each item is saved before it is removed, so a resume restores it. The script itself is not deleted or modified.

What doesn't get paused?

Anything that reaches a script without going through its public entry points: calls from other Workers over service bindings, Durable Object alarms, and Queue consumers keep running. Pages projects and non-Workers products are never paused either - pausing is a Workers operation. Their spend does count, though: D1, R2, KV and Durable Object requests are in the estimate, so an account can cross its cap on D1 and have its Workers paused.

Which API token permissions does it need?

The cost agent in your account needs a token with exactly these four, scoped to the account you want to protect:

  • Account · Workers Scripts · Edit - list scripts, change subdomain, domains and triggers
  • Zone · Workers Routes · Edit - remove and restore routes
  • Account · Account Analytics · Read - read your account's usage analytics for the estimate
  • Zone · Zone · Read - find the zones that carry routes

You set it as CF_API_TOKEN on the agent Worker in your own Cloudflare dashboard. It never transits Controlflare, which proves the agent works by making a real Cloudflare API call through it.

I don't want to give you my API token. What are my options?

You don't, and there is no longer any way to. The only way to configure an account is the open-source cost agent: you deploy it into your own Cloudflare account and set CF_API_TOKEN on it yourself, so the token is a secret on a Worker you own. Controlflare holds the agent's URL and a pairing secret, and reaches Cloudflare only through it. If you would also rather not keep your usage history and caps with us, self-host the dashboard too - Workers and D1 in your own account, or a container and a SQLite file on Kubernetes or Docker - which the self-hosting guide walks through step by step.

Can it resume automatically when the month rolls over?

Not yet. Controlflare never resumes anything on its own; you resume from the dashboard when you are ready, with one click for a single script or the whole account. Auto-resume at the start of a new billing month is on the roadmap as an opt-in.

Is Controlflare affiliated with Cloudflare?

No. Controlflare is an independent tool built for people who run Workers. It is not made, endorsed or supported by Cloudflare, Inc. It reaches Cloudflare's public APIs only through the agent in your account, with a token you create and can revoke at any time. Cloudflare and Workers are trademarks of Cloudflare, Inc.