Cloudflare

Supertab Connect runs on Cloudflare as a single Worker that both serves your RSL license at /license.xml and enforces the Crawler Authentication Protocol (CAP) on all other traffic — everything stays on your domain.

This flow uses the Wrangler CLI. Install it and authenticate once before you start:

npx wrangler login

Project Setup

mkdir supertab-worker && cd supertab-worker
npm init -y
npm install @getsupertab/supertab-connect-sdk

Worker

The Worker branches on the request path: /license.xml is proxied to the Supertab Connect API (keeping the URL on your domain), and every other request goes through CAP verification.

// src/index.ts
import { SupertabConnect, Env, EnforcementMode } from "@getsupertab/supertab-connect-sdk";

const MERCHANT_URN = "YOUR_WEBSITE_URN";

async function proxyLicenseXml(): Promise<Response> {
  const upstream = `https://api-connect.supertab.co/merchants/systems/${MERCHANT_URN}/license.xml`;
  const response = await fetch(upstream, { method: "GET", redirect: "manual" });
  return new Response(response.body, {
    status: response.status,
    headers: response.headers,
  });
}

export default {
  async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
    const url = new URL(request.url);

    // Serve the RSL license — handled before the SDK is involved.
    if (url.pathname === "/license.xml") {
      return proxyLicenseXml();
    }

    // Enforce CAP on everything else.
    return SupertabConnect.cloudflareHandleRequests(request, env, ctx, {
      enforcement: EnforcementMode.OBSERVE,
      analyticsEnabled: true,
    });
  },
};

Always pass ctx — the SDK uses its waitUntil to send events in the background without blocking the response: license-usage events whenever a token is verified, plus analytics events when analyticsEnabled is set.

If your Worker isn’t on your origin’s hostname (for example, it proxies to a separate backend), pass an originUrl option so the SDK forwards allowed traffic there. Deployments using Workers Routes on your own domain can omit it — fetch(request) already resolves to your origin via Cloudflare’s edge.

Wrangler Configuration

A single route sends all traffic on your domain to the Worker:

// wrangler.jsonc
{
  "name": "supertab-worker",
  "main": "src/index.ts",
  "compatibility_date": "2025-05-21",
  "compatibility_flags": ["nodejs_compat"],
  "routes": [
    { "pattern": "*yourdomain.com/*", "zone_id": "YOUR_ZONE_ID" }
  ]
}

The nodejs_compat flag is required for the SDK to function. Find your zone_id in the Cloudflare dashboard under your domain → Overview, in the API section.

API Key Secret

Store your Merchant API key (from the Supertab Connect dashboard) as a Worker secret:

npx wrangler secret put MERCHANT_API_KEY

Paste the key when prompted. The SDK reads it automatically from the env object at runtime.

Deploy

npx wrangler deploy

Use wrangler dev for local preview before deploying to production.

Enforcement Modes

Set enforcement in the handler options:

Mode	Behavior
`DISABLED`	Skip verification entirely — all requests pass through
`OBSERVE` (default)	Verify tokens and record outcomes, but never block
`ENFORCE`	Block requests with missing or invalid license tokens

Start in OBSERVE while you validate the integration, then move to ENFORCE when you’re ready to block.

Analytics & Bot Classification

Analytics is off by default. Pass analyticsEnabled: true (shown above) to emit an event for every bot request the Worker sees. Events are sent to Supertab Connect in the background — no additional Cloudflare configuration or log streaming is required. These events are what power bot classification and traffic reporting in your Supertab Connect dashboard. Without analyticsEnabled: true, the Worker still enforces CAP, but records nothing — your dashboard shows no bot activity.

Test

Confirm the license is served — visit https://yourdomain.com/license.xml; you should see your RSL license with your domain in the URL bar. Confirm CAP is enforcing — visit https://yourdomain.com in your browser and you should see your normal homepage, unaffected. Then send a request with an invalid token:

curl https://yourdomain.com -H 'Authorization: License not-valid-token'

You should get a 401 invalid-token response, confirming CAP is verifying license tokens at the edge.

Purge Cached License

No action needed. Cloudflare serves the latest license.xml immediately after you publish a new version — there is no cache to invalidate. Confirm the update at https://yourdomain.com/license.xml.

Deploy in Your CDN

CDN-agnostic guide covering RSL serving, CAP enforcement, and robots.txt.

Other CDNs

Generic CDN patterns for platforms not listed above.

Introduction

Guides

Licensing

Reference

Project Setup

Worker

Wrangler Configuration

API Key Secret

Deploy

Enforcement Modes

Analytics & Bot Classification

Test

Purge Cached License

Deploy in Your CDN

Other CDNs

​Project Setup

​Worker

​Wrangler Configuration

​API Key Secret

​Deploy

​Enforcement Modes

​Analytics & Bot Classification

​Test

​Purge Cached License

​Related Docs

Deploy in Your CDN

Other CDNs

Project Setup

Worker

Wrangler Configuration

API Key Secret

Deploy

Enforcement Modes

Analytics & Bot Classification

Test

Purge Cached License

Related Docs