Fixing Cloudflare Worker CI/CD: The One Checkbox That Saves 3 Minutes
Configure the Cloudflare API token with the "Edit Cloudflare Workers" scope instead of "Read All Resources" to avoid authentication errors.
Configure the Cloudflare API token with the "Edit Cloudflare Workers" scope instead of "Read All Resources" to avoid authentication errors.
Summary
Deploying a Cloudflare Worker with GitHub Actions failed repeatedly with "Authentication error [code: 10000]" because the API token used the "Read All Resources" template, which lacks write permission. The fix was to select the "Edit Cloudflare Workers" template, giving write access to the Workers resource while keeping other scopes minimal. The article explains that the account ID is public and should be stored as a secret only for convenience, whereas the API token is the real secret.
The CI/CD pipeline uses actions/checkout@v4 and cloudflare/wrangler-action@v3, passing apiToken and accountId as secrets. The deployment completes in 47 minutes with 25 lines of code across three files: src/index.js, wrangler.toml, and .github/workflows/deploy.yml. The article also notes that the pipeline is the real value, not the simple hello‑world Worker.
Key changes
- Authentication error [code: 10000] caused by using a "Read All Resources" token lacking write permission
- Correct token scope: "Edit Cloudflare Workers" template provides write access to Workers
- Account ID is public; only API token is secret
- wrangler-action v3 requires apiToken and accountId secrets
- GitHub Actions workflow uses actions/checkout@v4 and cloudflare/wrangler-action@v3
- CI/CD pipeline deploys in 47 minutes with 25 lines of code
- Three files: src/index.js, wrangler.toml, .github/workflows/deploy.yml
- Enable write access to Workers resource to avoid auth failures