Cloudflare Temporary Accounts: Let Agents Deploy Without OAuth Flows

Official Sources#

Last updated: October 18, 2026

Updated October 18, 2026: Corrected against Cloudflare's claim deployments docs. The integration example matched claim URLs against a dash.cloudflare.com/temporary-claim/ path; Wrangler prints https://dash.cloudflare.com/claim-preview?claimToken=.... The example also ran wrangler logout before every deploy, which clears Wrangler's cached temporary account, so each run created a new account. The 60-minute window is a claim deadline, not an inactivity timer that redeploys reset, Wrangler reuses a cached temporary account rather than creating a new one on every run, Cloudflare recommends a permanent account for CI/CD, and Wrangler requires Node.js 22 or later. The supported-products table now includes the documented limits.

AI agents hit a wall when they need to deploy code. The problem is not the deployment itself - it is the account creation flow that precedes it. OAuth popups, dashboard click-throughs, API token copy-paste rituals, multi-factor authentication challenges - all designed for humans with browsers and patience.

Cloudflare addressed this on June 19, 2026 with temporary accounts. An agent running Wrangler 4.102.0 or later can now deploy a Worker, a D1 database, KV storage, Durable Objects, or any supported Cloudflare resource without creating an account first. The deployment stays live for 60 minutes. During that window, a human can claim the account and make it permanent.

How It Works#

The mechanism is a single CLI flag:

wrangler deploy --temporary

When an agent runs this command without credentials, Wrangler solves a proof-of-work challenge, provisions a temporary preview account, deploys the Worker to workers.dev, and prints the live deployment URL and a claim URL. On later runs it reuses the cached temporary account while its credentials and claim URL remain valid, and the output says whether the account was created or reused.

The agent does not need to navigate a browser, handle OAuth callbacks, or parse emails. It gets infrastructure.

The 60-Minute Window#

The intended user must complete the claim within 60 minutes. Cloudflare's docs are specific that opening the claim URL before the deadline is not enough; the user has to sign in or create an account and finish the dashboard prompts. That is enough time for an agent to:

1. Deploy an initial version
2. Test the endpoint
3. Iterate with fixes
4. Redeploy to the same cached temporary account
5. Hand the claim URL to a human for permanent ownership

Redeploys do not extend the deadline. If the temporary credentials or claim URL expire, rerunning wrangler deploy --temporary provisions a new account and prints a new claim URL.

When a human completes the claim, the Worker and supported resources stay in the now-permanent account. To keep deploying with Wrangler, run wrangler login and deploy without --temporary.

If nobody completes the claim in time, Cloudflare deletes the account and its resources.

What You Can Deploy#

The temporary accounts feature supports a significant slice of the Cloudflare developer platform:

Temporary credentials do not grant every operation for these resources, and unsupported operations return an authorization error.

This covers most common deployment patterns. An agent can spin up an API with a database backend, deploy a static site, or launch a real-time application with Durable Objects - all without a pre-existing account.

Version Requirements#

You need Wrangler 4.102.0 or later. Check your version:

wrangler --version

If you are behind, update:

npm install -g wrangler@latest

One gotcha: --temporary supports unauthenticated use only. Existing OAuth, API token or global API key credentials cause an error, so run wrangler logout once before testing. Do not run it before every deploy: logging out also clears the cached temporary account.

What This Means for Agent Workflows#

The pattern Cloudflare enabled here is "deploy first, claim later." It inverts the traditional flow where account creation is a prerequisite for any action.

For agent developers, this opens several use cases:

Prototype deployment agents. An agent can take a description like "build me an API that converts markdown to PDF" and ship a working endpoint without any credential handoff. The human reviews the live deployment before claiming it.

Throwaway previews from tools you do not control. Cloudflare's docs say production and CI/CD should use a permanent account with wrangler login or an API token. Temporary accounts fit previews and first-time evaluations, where a short-lived URL and a claim link are the whole point.

Sandbox environments. Agents testing infrastructure code can deploy to throwaway Cloudflare accounts, validate behavior, and clean up automatically after 60 minutes.

Demo flows. A conversational agent can deploy a working example during a support interaction. The user sees it live, decides if they want it, and claims or abandons it.

The Agent Discovery Pattern#

Cloudflare built in a helpful fallback. When an agent runs wrangler deploy without credentials in a non-interactive session, Wrangler 4.102.0 or later prints a message telling it to rerun with --temporary and that Wrangler will use a temporary account and print a claim URL. An agent parsing CLI output can discover the feature and adapt without explicit instructions.

This matters because it means agents designed for credentialed deployments can gracefully degrade to temporary deployments when credentials are unavailable. No special-case code required - just read the error message.

Integration Example#

Here is a minimal agent step that deploys a Worker and returns both URLs. The claim URL pattern matches the Wrangler output shown in Cloudflare's docs:

import { spawnSync } from 'node:child_process';

function deployTemporary(projectPath: string) {
  // Run `wrangler logout` once beforehand if this machine has credentials.
  // Do not log out on every run: it clears the cached temporary account.
  const run = spawnSync('npx', ['wrangler', 'deploy', '--temporary'], {
    cwd: projectPath,
    encoding: 'utf-8',
  });
  if (run.status !== 0) {
    throw new Error(`wrangler deploy failed: ${run.stderr}`);
  }
  // Search both streams so the parse does not depend on which one Wrangler uses.
  const output = `${run.stdout}\n${run.stderr}`;

  const deployUrl = output.match(/https:\/\/[^\s]+\.workers\.dev/)?.[0];
  const claimUrl = output.match(/https:\/\/dash\.cloudflare\.com\/claim-preview\?claimToken=[^\s]+/)?.[0];

  return { deployUrl, claimUrl };
}

Treat claimUrl like a bearer credential: anyone with it can claim the account. Hand it only to the intended user, and keep it out of logs, analytics and public issue comments.

Limitations#

The 60-minute window is both the feature and the constraint. For deployments that need to survive without human intervention, temporary accounts are not the answer - you still need proper credentials.

Not every Cloudflare product is supported. Anything outside the table above, such as R2 or Workers AI, is not in Cloudflare's supported list. Account creation is also rate limited and protected by a proof-of-work check.

The claim flow requires a human with a browser. Platforms can provision temporary accounts through the REST API at api.cloudflare.com/client/v4/provisioning/previews, but the claim itself happens when the intended user signs in through the claim URL.

Broader Context#

This is part of a pattern where infrastructure providers are adapting to agentic workloads. Stripe and WorkOS have similar agent-friendly provisioning flows. The thesis: if agents are going to deploy production infrastructure, the infrastructure needs to meet them halfway.

For developers building agents that touch deployment, this removes one of the harder integration problems. You no longer need to build OAuth handling, token management, or credential storage into your agent just to deploy a Worker.

FAQ#

Does temporary deployment cost anything?#

Cloudflare has not published pricing specific to temporary accounts. Claimed accounts follow normal Workers pricing. Unclaimed deployments that expire do not appear to incur charges.

Can I extend the 60-minute window?#

No. The intended user must complete the claim within 60 minutes, and redeploying does not reset that deadline. If the credentials or claim URL expire, rerun wrangler deploy --temporary to get a new account and claim URL.

What happens to data in D1 or KV if I do not claim?#

If nobody completes the claim in time, Cloudflare deletes the account and its resources, including D1 databases and KV namespaces.

Can multiple agents share a temporary account?#

Wrangler caches the temporary account in the current operating-system user's global configuration directory and reuses it while it is valid, so runs from the same user share it. Cloudflare says not to share that directory between platform users. Separate users or machines get separate temporary accounts.

Does this work with wrangler.toml configuration?#

Yes. Your standard wrangler.toml configuration applies to temporary deployments. Bindings, routes, and other settings work as expected.

Is this available on the free tier?#

No Cloudflare account is needed before you claim, so there is no plan to choose up front. After claiming, the account follows normal Cloudflare plans and pricing.

Can I use this for production?#

No. Cloudflare's docs say production and CI/CD should use a permanent account with wrangler login or an API token. Use temporary accounts for prototypes, previews and handoff flows, then claim the account and switch to normal authentication.

What version of Node.js do I need?#

Wrangler 4.102.0 and later declare Node.js 22 or newer in their package engines.

Continue Reading#

• Agents 101: How to Build and Deploy Anything with AI Agents
• Cloudflare Ships Behavioral Trust for the Agentic Internet: 206M Events, 73K Zones
• Cloudflare Billable Usage API: Programmatic Cost Visibility for Agent-Run Accounts

Sources#

• Temporary Cloudflare Accounts for AI Agents - Cloudflare Blog, June 19, 2026
• Temporary accounts for AI agent deployments - Cloudflare Changelog, June 19, 2026
• Wrangler CLI Documentation - Cloudflare Workers docs