`sst deploy` not authenticating with Cloudflare properly

[itzcull]

Version 0.0.398 of ion CLI

I'm using the 'Global API Key' for my Cloudflare account, I'm not able to deploy at all

Trying to set KV values during sst deploy step

The Config

[jayair]

Does setting it in the environment not work? https://ion.sst.dev/docs/start/cloudflare/hono/#set-the-cloudflare-api-token

[itzcull]

Removing the provider config value for apiKey and just relying on environment variable produces this

Let me know what other details I can provide to help you with this

[itzcull]

I tried removing explicit configuration, still the same issue as outlined in issue description

.env files contains my cloudflare email for CLOUDFLARE_EMAIL, and 'Global API Key' for CLOUDFLARE_API_KEY

[itzcull]

sst deploy was able to create a KV namespace, but then the rest of the calls failed.

I'm seeing similar API call flake in #ion Discord channel https://discord.com/channels/983865673656705025/1177071497974648952/1244473373992681572

[thdxr]

is there a reason you cannot use the newer api token system? i think we might have implemented some things that need it

[itzcull]

What's new and what's not? I've tried both explicitly defining them in the provider object, and just using the environment variables. Can you link the documentation that explains it?

[itzcull]

As per https://ion.sst.dev/docs/start/cloudflare/hono/#set-the-cloudflare-api-token

I've set the required cloudflare environment variables in the .env file at the root of my repo, the same level that sst.config.ts is located

Still can't authenticate.

[itzcull]

It'd be good to have documentation on what permissions SST needs from Cloudflare, so I don't have to use my account's global api key. All worker related scopes have 'EDIT' permissions, still get this

[thdxr]

the cloudflare permissions system is tricky - the permissions you need depend on what you're deploying

i'm currently using it by setting CLOUDFLARE_API_TOKEN=xxx in my .env and these are the permissions i have set

[itzcull]

Thanks Dax, this will help heaps. I'll let you know if it works for me and we can take it from there. For what it's worth, I'm only deploying my Remix app right now, using the 'components' in the documentation.

I've seen others ask about what perms are needed for Cloudflare, maybe you should share in Discord if you haven't already.

[itzcull]

Running sst deploy with those exact token permissions yields the same thing....

Is this plain_text_binding.15.text business a Terraform thing?

[itzcull]

https://github.com/sst/ion/blob/prodution/pkg/platform/src/components/cloudflare/worker.ts

I've been looking here trying to figure out what might be needed.

[itzcull]

Turns out the keys for my PlanetScale database's credentials were wrong, it happened to be the 15th and 16th position in the plainTextBindings passed to Pulumni.

Closing this, thanks for your time.