// Cloudflare integration
Watch Workers, Pages, and zones from a single read-only token.
One read-only API token imports every Cloudflare resource across every account it reaches. Beaam reads the GraphQL Analytics API each minute and alerts when something is actually failing — not when traffic merely changes.
Curated deliberately: a short list worth your attention, not every metric that exists. Each one needs repeated evidence before Beaam calls it — a single bad reading is not an incident.
| Signal | When Beaam speaks up |
|---|---|
| Worker error rate | Errors as a share of invocations. A window with no traffic reports 0, so a quiet Worker never pages overnight. |
| Pages Functions error rate | Same measure for a Pages project's Functions. |
| Durable Object error rate | Errors as a share of DO invocations. |
| Zone 5xx ratio | Share of edge responses that were 5xx, weighted by request volume so a busy bucket isn't averaged against an idle one. |
Charted on the service page and there for context when something does break — but it will not wake you unless you ask it to.
setup
Connect a read-only API token; Beaam imports every resource it can reach.
Beaam applies sensible defaults. Threshold configuration is optional, not onboarding.
access
Beaam never writes to Cloudflare. Credentials are encrypted with AES-256-GCM using a key held as a deploy secret, and are deleted immediately when you disconnect.
4 signals can raise an incident: Worker error rate, Pages Functions error rate, Durable Object error rate, Zone 5xx ratio. Everything else is collected for context but stays quiet until you opt in.
Connect a read-only API token; Beaam imports every resource it can reach. Most connections are watching within a few minutes, and you can send a test alert immediately to prove the path works end to end.
No. Beaam only ever performs read operations — there is no code path that writes to a connected provider. Worth separating from that: what Beaam *does* and what a token *permits* are different things. Where Cloudflare offers a read-scoped credential, use it; some providers only issue tokens carrying broader rights than Beaam uses, which is a property of their API rather than of Beaam's behaviour. Scope it as narrowly as the provider allows. Credentials are encrypted with AES-256-GCM before storage and deleted the moment you disconnect.
The free plan covers two integrations and five watched services, with email, push, Slack and webhook alerts. Solo is $19/month flat for unlimited integrations and services, adding SMS — there is no per-host, per-check or per-alert metering.
Most stacks are several services with seams between them, and the seams are where the damaging failures hide. Beaam correlates across every connected integration, so a database problem reads as one incident rather than five alarms from five tools.