CFRead-onlyHosting
Cloudflare costs, per zone and product
Cloudflare bills by account; you think in products. Glow maps zones and Workers to products and shows this month’s billable usage for each, so the Workers paid plan on a dead side project doesn’t hide.
What Glow shows from Cloudflare
Billable usage this month
Workers requests, R2, D1, KV and Workers AI, as dollars.
Zones mapped to products
Each zone and Worker lands under the product it serves.
Traffic next to cost
Requests and bandwidth per zone from Analytics, next to what they cost.
Idle spend
Paid add-ons on zones with no traffic, flagged as levers.
Exactly what Glow can access
Glow asks for an account API token with Read permissions only.
- Account: Billing Read
- Account: Account Analytics Read
- Account: Workers Scripts Read
- Zone: Analytics Read
- Account API Tokens Read (so Glow can check this token has no Edit permission)
How Glow checks it
Glow verifies the token is active, then reads its own policy: every permission group must be a Read group, or the token is refused.
Related
Cloudflare + Glow: questions
Can I use my Global API Key?
No. The Global API Key can do anything on your account. Glow only accepts scoped API tokens with Read permissions.
Does this include Workers AI and AI Gateway?
Workers AI usage is part of billable usage. AI Gateway logs are coming as an optional Read permission.
Can I disconnect Cloudflare later?
Any time. Remove the connection in Glow and the sealed key is destroyed; revoke it at Cloudflare too if you like. Your history stays until it expires.
See your company lit up.
Join the beta. Connect Stripe and one AI key, and see every product’s money in, money out and AI bill in about a minute.
- Read-only keys
- Never shown again
- 2FA + Face ID
- 7-day trial