Skip to main content
Chat

What "the Setup Token Deletes Itself" Means, and Why Flarepipe: Chat Is Built That Way

• Tom Morton

The Flarepipe: Chat landing page makes a claim that deserves more than a bullet point: you paste one Cloudflare token, the plugin builds everything it needs in your account, and then it deletes that token. People who run WordPress sites for a living have learned to be suspicious of any plugin that asks for an API key, and they are right to be. This post explains what the plugin does with the token at each step, and why we built it this way rather than the usual way.

The usual way, and what is wrong with it

Most plugins that talk to a cloud service ask you for a key once and store it in the options table forever. The key is usually broader than the plugin needs, because asking for the exact minimum is fiddly and support tickets are expensive. So a credential that can read your DNS, deploy code and create more credentials sits in wp_options, in every database backup, and behind every SQL injection bug in every other plugin on the site.

Flarepipe: Chat has a genuine need for broad permissions, but only for a few minutes. Provisioning a chatbot means creating a Worker, a Vectorize index, possibly a workers.dev subdomain, pushing a secret, and minting a second token. Running the chatbot afterward needs almost none of that. The design follows from that split: ask for a lot briefly, keep very little permanently.

What the setup token can do

The wizard links you to the Cloudflare token screen and lists what to tick. The Cloudflare setup guide explains each one; the short version is:

  • Account > Workers Scripts > Edit, to upload the Worker that answers questions.
  • Account > Workers AI > Edit, so the Worker can call the models. Read is not enough.
  • Account > Vectorize > Edit, to create the index your content is stored in.
  • Account > Account Settings > Read, to resolve your account ID and workers.dev subdomain.
  • User > API Tokens > Edit, to mint the replacement token and to delete this one afterward.

If you want the bot served from a hostname like chat.yoursite.com, there is an optional set of zone permissions on top. Skip them and setup still succeeds on a workers.dev URL.

The last one, API Tokens Edit, is a permission most people have never granted a plugin, and it is what makes the self-cleaning possible.

Where the token lives during setup

The setup token exists in your browser’s form field and in the request bodies of the wizard’s calls to your own site, which forwards them to the Cloudflare API. It is never written to the database, not even temporarily, and not even encrypted. If the wizard fails halfway, there is nothing to clean up on the WordPress side; you create a fresh token and run it again, and every provisioning step treats “already exists” as success, so the second run repairs rather than duplicates.

The four steps, and where the swap happens

The wizard reports four steps, described in the installation guide:

  1. Verify token and account. Confirms the token works and, if it covers several Cloudflare accounts, asks which one to build in.
  2. Deploy worker and vector index. Creates the index, ensures the workers.dev subdomain exists, uploads the Worker with its bindings, and generates the shared secret that protects content ingestion.
  3. Downgrade to a minimal token. This is the step the headline is about.
  4. Index your content. Queues your published posts and pages for chunking and embedding.

Step three does two things in a fixed order. First it uses the setup token to mint a new token through Cloudflare’s token API, scoped to exactly two account permissions: Workers Scripts Edit and Vectorize Edit. That is the minimum needed to redeploy the Worker when the plugin updates and to rebuild the index if you change the embedding model. If you granted the optional zone permissions, it tries to include them so you can attach a custom domain later from the settings page, and if Cloudflare refuses, it falls back to the account-only token rather than failing setup.

The new token is encrypted with AES-256-GCM, keyed from your site’s WordPress salts, and stored. Only after that succeeds does the plugin ask Cloudflare to verify the setup token, which returns the token’s own ID, and sends a delete request for that ID. The setup token stops working the moment that call succeeds, which is why it runs last.

The checkbox

The wizard has a box labeled “Delete the setup token from Cloudflare when finished.” It is ticked by default. The only reason to untick it is that you are deliberately using one token to set up several sites in a row, in which case delete it yourself when you are done. If the delete call fails for any reason, the wizard tells you so and points you at My Profile > API Tokens in the Cloudflare dashboard to remove it by hand.

Go and look there anyway. After a successful setup you should see the operational token the plugin minted, and you should not see the setup token. That is the promise, and it takes thirty seconds to check without trusting us.

What is left on your site

One encrypted token that can upload a Worker script and write to a Vectorize index on one account, plus a 64-character ingestion secret, also encrypted, that stops anyone but your site from writing to the index. The stored token cannot read your account settings, create other tokens, or see anything outside the chatbot’s own resources, and it cannot touch DNS unless you chose the custom domain option. The plugin needs the openssl PHP extension for the encryption, and setup will not proceed without it, because storing the operational token in plain text would undo most of what this post describes. The security page lists everything stored and where.

Whose login you use

Cloudflare API tokens belong to the user who created them, not to the account. If the person who ran the wizard later loses access to the Cloudflare account, the operational token dies with them and the plugin needs re-onboarding by someone still on the account. If you are setting this up for a client, run the wizard from a login that will outlast the engagement.

Flarepipe: Chat is in beta and goes out to the waitlist rather than as a public download. If the token story is the reason you have been waiting, join the list and we will send you the plugin when the beta opens.