Skip to content

Getting Started

Use this page to deploy your own Rafiki on Cloudflare and Modal.

What You Are Deploying

Rafiki runs as two connected pieces:

  • a Cloudflare Worker plus Durable Objects for the public URL, auth, sessions, and streaming
  • a Modal backend for agent execution, tools, and artifacts

Deploy Modal first, then Cloudflare, then run one smoke test through the Worker.

Before You Start

  • Python 3.11+
  • uv
  • Node.js 20+
  • a Modal account
  • a Cloudflare account
  • uv run modal setup
  • wrangler login

Step 1: Configure Shared Secrets

These are the main secrets you set during deployment:

  • INTERNAL_AUTH_SECRET
  • SESSION_SIGNING_SECRET
  • OPENAI_API_KEY

Where they belong:

  • INTERNAL_AUTH_SECRET: local .env, Modal internal-auth-secret, and the Cloudflare Worker secret
  • SESSION_SIGNING_SECRET: Cloudflare Worker secret and your token-minting environment
  • OPENAI_API_KEY: Modal openai-secret

Shared-secret rule:

  • INTERNAL_AUTH_SECRET must match in your local .env, Modal internal-auth-secret, and the Cloudflare Worker secret.

Step 2: Deploy the Modal Backend

Use Deploy to Modal for the exact commands.

Minimum path:

cp .env.example .env
# edit .env and set INTERNAL_AUTH_SECRET=<shared-internal-secret>
uv sync --extra dev
source .venv/bin/activate
uv run modal setup
uv run modal deploy -m modal_backend.deploy

For local development, use uv run modal serve -m modal_backend.main instead.

Step 3: Deploy the Cloudflare Worker

Use Deploy to Cloudflare for the exact commands.

Minimum path:

cd edge-control-plane
npm install
wrangler login
wrangler secret put INTERNAL_AUTH_SECRET
wrangler secret put SESSION_SIGNING_SECRET
npm run deploy

Step 4: Verify With /health and One /query

Use Verify Deployment for the exact commands.

The shortest proof is:

  1. GET /health on your Worker URL
  2. mint a session token with edge-control-plane/scripts/generate-session-token.js
  3. send one POST /query through the Worker

After Your Stack Is Live