Cloudflare Worker

Before you start

A firewall integration enforces the signed policy bundle of your site in front of your origin: block, redirect, challenge and token-gated routes. It fetches the bundle from GET /v1/policies/<site key>, verifies its signature offline and decides every request the same way in every language. It does not replace verifying tokens in your own code. A request that reaches your origin another way (a direct IP, another hostname, a path the integration was not installed on) is never evaluated, so let only the integration reach the origin. See firewall policies.

The secret key (rgsk_...) is needed only for requireToken rules. Without it such a rule applies its onError setting.

Install and mount

A Worker template that wraps the firewall core. Put it on a route in front of your origin (routes in wrangler.jsonc); an allowed request is forwarded with fetch(request). Or set RG_ORIGIN to forward to a fixed origin URL.

Optional settings: RG_SIG_SECRET (a secret that enables X-RG-Sig), RG_INITIAL_FAIL_MODE (open by default, or closed) and a KV binding named RG_STATE that remembers the highest bundle version across isolates (replay protection for older bundles).

Every x-rg-* request header is deleted before your origin sees it, then the decision’s X-RG-Score, X-RG-Verdict and X-RG-Rule are set. They go to the origin only, never onto block or challenge answers.

If you cache origin responses behind this Worker, never cache a response that depends on X-RG-Score or X-RG-Verdict.

setup.sh

# Vars (wrangler.jsonc): RG_SITE_KEY=rgpk_..., RG_API_BASE=https://api.revokegpt.com
# Secret, needed only for requireToken rules:
wrangler secret put RG_SECRET_KEY

Not published yet

This integration package is built and tested in the repository but not published to its registry yet. Install it from a checkout until the first release.

Keep routing case-sensitive

Firewall rules match paths case-sensitively, so /ADMIN is not /admin. If your origin routes case-insensitively (IIS, a case-folding proxy or framework), /ADMIN can reach the /admin handler while a rule on /admin never sees it. Make the origin case-sensitive, or write a rule for each spelling it serves.