Permissions
& privacy.
Know what you’re sharing, what we create, and what stays yours.
No GitHub account is needed to get SAM running in Cloudflare. Signing in afterwards requires GitHub, GitLab or Google; there is no email login.
What you authorize
Default bootstrap mode requests account read access and permission to deploy Workers. Cloudflare’s permissions may cover existing Workers in the selected account. Only approve accounts you intend to use. Experimental full installation requires broader resource and token-provisioning permissions; it is not enabled or verified for general use.
Temporary access
The installer handles OAuth tokens server-side in an isolated session. Hosted access expires after 15 minutes by default, bounded by token expiry. In this preview branch, handoff removes hosted OAuth and deployment-credential copies but retains a bounded claim record until the original expiry so interrupted handoff can be retried. Disconnect and expiry attempt cleanup and revocation; provider failures can delay deletion or revocation. Use Cloudflare’s authorized-applications screen to revoke access yourself if needed. No central refresh token is retained.
Your password is entered only on Cloudflare. This app does not use analytics, third-party scripts, or application request logging. Hosting and network providers may still process request metadata.
If cleanup is interrupted after a grant expires, this tab can keep a nonsecret cleanup reference. Reconnect with Cloudflare and choose “Finish cleanup” to remove unused setup credentials. The reference grants no access by itself; credentials already owned by your installation service are preserved.
What stays in your account
Default mode creates a maintenance Worker without an ongoing Cloudflare deployment token. This preview branch adds durable recovery: save the browser-generated credential before claiming ownership. Its hash stays in your account; maintenance sessions last 24 hours by default. Recovery login replaces the previous active session. Replacement credentials become active only after you save and confirm them. Earlier hosted revisions may still have temporary owner access; check the displayed source version.
Experimental full mode temporarily handles installation credentials during bootstrap, then transfers deployment and storage authority to your maintenance service and narrower runtime authority to SAM. This lifecycle still needs live validation, including the effect of OAuth revocation on derived credentials. It is not a claim that credentials never reach our service. Disconnecting does not delete transferred resources. Review resource identities and backups before removing a test installation; automatic uninstall is not provided.
Experimental full-mode builders preserve approved SAM source and Git history, build artifacts and deployment checkpoints in your account's R2 storage. Saved source is verified against its commit, tree and content digest before reuse. Toolchain and dependency downloads can still require network access. The approved code and its build dependencies are trusted deployment code running with your installation's authority; nested build containers are not a security boundary against malicious build scripts.
Your choice
You can deploy this same installer yourself and register your own OAuth client. Source availability helps you review the app; it does not guarantee that a hosted operator cannot modify its deployment.