Run the installer
on your terms.
Prefer to handle Cloudflare access yourself? Deploy this same open-source installer in your own account.
No GitHub account is needed to get SAM running in Cloudflare. Signing in afterwards requires GitHub, GitLab or Google; there is no email login.
1. Get the source
You’ll need Node.js 22+, pnpm 9.15.9, a Workers Paid account, and an active domain in Cloudflare. Inspect the deployed source →
git clone https://github.com/raphaeltm/simple-agent-manager.git
cd simple-agent-manager
# For an unmerged preview, check out the revision linked above.
pnpm install --frozen-lockfile2. Configure your deployment
Set CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID through your
shell’s secret manager. Never commit credentials or paste them into chat.
The deployment token needs Account Settings Read, Workers Scripts Edit, OAuth Client Read/Write, and zone permissions for Workers Custom Domains and Workers Routes. Scope it to the account and zone you intend to use.
export BASE_DOMAIN=example.com
pnpm --filter @simple-agent-manager/installer run deploy3. Open your installer
The script deploys at https://install.example.com, registers a private OAuth
client, and saves its credentials as Worker secrets. Keep those credentials private.
Rerunning preserves the existing client and secret.
While this prototype is unmerged, check out the revision shown by “Inspect the deployed source” before deploying. The default branch may not include the installer yet.
Before sharing it with others
Private OAuth clients work for members of their parent account. Serving other users requires Cloudflare’s publisher verification and public promotion. Promotion is permanent and is never performed automatically by this script.
What you’re deploying
The standard command deploys bootstrap-only mode, separate from SAM. This preview branch adds durable owner recovery: save the browser-generated credential before claiming your service. The hosted address may still run an earlier revision; check its source version.
Experimental full installation and update machinery is under development. It is not enabled by this command and has not completed authenticated OAuth, credential-revocation, and full in-account build validation. Use the established SAM self-hosting guide for a complete installation. No working full-mode enablement recipe is provided yet.