Examples

import { WorkerEntrypoint } from "cloudflare:workers";

// Cached entrypoint. Workers Caching sits in front of this — on a hit,
// the cached response is returned and `fetch` below is never invoked.
export class CachedAPI extends WorkerEntrypoint {
	async fetch(request) {
		const data = await loadExpensiveData(request);

		return new Response(JSON.stringify(data), {
			headers: {
				"Content-Type": "application/json",
				// All authenticated callers see this same response on a hit.
				"Cache-Control": "public, max-age=60",
			},
		});
	}
}

// Default entrypoint. Runs on every request to authenticate the caller,
// then forwards to the cached entrypoint.
export default {
	async fetch(request, env, ctx) {
		if (!(await authenticate(request, env))) {
			return new Response("Unauthorized", { status: 401 });
		}

		// Strip the Authorization header before forwarding. Otherwise the
		// request would trigger Cloudflare's automatic bypass for
		// authenticated requests, and nothing would ever be cached.
		const forwarded = new Request(request);
		forwarded.headers.delete("Authorization");

		// Caching is disabled for this gateway entrypoint (see the Wrangler
		// configuration above), so it runs on every request. Forward to the
		// cached CachedAPI entrypoint and return its response directly.
		return ctx.exports.CachedAPI.fetch(forwarded);
	},
};

async function authenticate(request, env) {
	const token = request.headers.get("Authorization")?.replace(/^Bearer\s+/, "");
	return token === env.API_TOKEN;
}

async function loadExpensiveData(request) {
	// Replace with your real data source — D1, KV, an origin, and so on.
	return { timestamp: Date.now() };
}

import { WorkerEntrypoint } from "cloudflare:workers";

interface Env {
	API_TOKEN: string;
}

// Cached entrypoint. Workers Caching sits in front of this — on a hit,
// the cached response is returned and `fetch` below is never invoked.
export class CachedAPI extends WorkerEntrypoint<Env> {
	async fetch(request: Request): Promise<Response> {
		const data = await loadExpensiveData(request);

		return new Response(JSON.stringify(data), {
			headers: {
				"Content-Type": "application/json",
				// All authenticated callers see this same response on a hit.
				"Cache-Control": "public, max-age=60",
			},
		});
	}
}

// Default entrypoint. Runs on every request to authenticate the caller,
// then forwards to the cached entrypoint.
export default {
	async fetch(request, env, ctx): Promise<Response> {
		if (!(await authenticate(request, env))) {
			return new Response("Unauthorized", { status: 401 });
		}

		// Strip the Authorization header before forwarding. Otherwise the
		// request would trigger Cloudflare's automatic bypass for
		// authenticated requests, and nothing would ever be cached.
		const forwarded = new Request(request);
		forwarded.headers.delete("Authorization");

		// Caching is disabled for this gateway entrypoint (see the Wrangler
		// configuration above), so it runs on every request. Forward to the
		// cached CachedAPI entrypoint and return its response directly.
		return ctx.exports.CachedAPI.fetch(forwarded);
	},
} satisfies ExportedHandler<Env>;

async function authenticate(request: Request, env: Env): Promise<boolean> {
	const token = request.headers.get("Authorization")?.replace(/^Bearer\s+/, "");
	return token === env.API_TOKEN;
}

async function loadExpensiveData(request: Request): Promise<unknown> {
	// Replace with your real data source — D1, KV, an origin, and so on.
	return { timestamp: Date.now() };
}

import { WorkerEntrypoint } from "cloudflare:workers";

export class CachedAPI extends WorkerEntrypoint {
	async fetch(request) {
		// ctx.props.userId is part of the cache key, so this response
		// is cached separately for every userId.
		const { userId } = this.ctx.props;
		const data = await loadUserData(userId);

		return new Response(JSON.stringify(data), {
			headers: {
				"Content-Type": "application/json",
				"Cache-Control": "public, max-age=60",
			},
		});
	}
}

export default {
	async fetch(request, env, ctx) {
		const userId = await authenticate(request, env);
		if (!userId) {
			return new Response("Unauthorized", { status: 401 });
		}

		const forwarded = new Request(request);
		forwarded.headers.delete("Authorization");

		// The gateway's cache is disabled, so it runs on every request.
		// Pass the authenticated userId to the cached entrypoint via props —
		// this becomes part of the cache key.
		return ctx.exports.CachedAPI.fetch(forwarded, {
			props: { userId },
		});
	},
};

async function authenticate(request, env) {
	// Replace with your real auth — JWT verification, token lookup, and so on.
	return "user-42";
}

async function loadUserData(userId) {
	return { userId, timestamp: Date.now() };
}

import { WorkerEntrypoint } from "cloudflare:workers";

interface Env {
	API_TOKEN: string;
}

interface Props {
	userId: string;
}

export class CachedAPI extends WorkerEntrypoint<Env, Props> {
	async fetch(request: Request): Promise<Response> {
		// ctx.props.userId is part of the cache key, so this response
		// is cached separately for every userId.
		const { userId } = this.ctx.props;
		const data = await loadUserData(userId);

		return new Response(JSON.stringify(data), {
			headers: {
				"Content-Type": "application/json",
				"Cache-Control": "public, max-age=60",
			},
		});
	}
}

export default {
	async fetch(request, env, ctx): Promise<Response> {
		const userId = await authenticate(request, env);
		if (!userId) {
			return new Response("Unauthorized", { status: 401 });
		}

		const forwarded = new Request(request);
		forwarded.headers.delete("Authorization");

		// The gateway's cache is disabled, so it runs on every request.
		// Pass the authenticated userId to the cached entrypoint via props —
		// this becomes part of the cache key.
		return ctx.exports.CachedAPI.fetch(forwarded, {
			props: { userId },
		});
	},
} satisfies ExportedHandler<Env>;

async function authenticate(
	request: Request,
	env: Env,
): Promise<string | null> {
	// Replace with your real auth — JWT verification, token lookup, and so on.
	return "user-42";
}

async function loadUserData(userId: string): Promise<unknown> {
	return { userId, timestamp: Date.now() };
}

import { WorkerEntrypoint } from "cloudflare:workers";

export class CachedAssets extends WorkerEntrypoint {
	async fetch(request) {
		const accept = request.headers.get("Accept-Encoding") ?? "";
		const wantsBrotli = accept.includes("br");

		const { body, encoding } = wantsBrotli
			? await loadBrotli(request)
			: await loadGzip(request);

		return new Response(body, {
			headers: {
				"Content-Type": "application/javascript",
				"Content-Encoding": encoding,
				"Cache-Control": "public, max-age=86400, immutable",
				// One variant per distinct Accept-Encoding value the cached
				// entrypoint sees. The gateway below normalizes that value.
				Vary: "Accept-Encoding",
			},
		});
	}
}

export default {
	async fetch(request, env, ctx) {
		// On Cloudflare, the eyeball's Accept-Encoding is usually rewritten
		// to a canonical value before the Worker runs. Restore it from
		// request.cf.clientAcceptEncoding so the cached entrypoint sees
		// what the client actually sent — and so Vary keys variants on
		// the real value.
		const original = request.cf?.clientAcceptEncoding;

		const forwarded = new Request(request);
		if (original) {
			forwarded.headers.set("Accept-Encoding", original);
		}

		// The gateway's cache is disabled (see the Wrangler configuration
		// above), so it runs on every request and always restores
		// Accept-Encoding before forwarding to the cached entrypoint.
		return ctx.exports.CachedAssets.fetch(forwarded);
	},
};

async function loadBrotli(request) {
	// Replace with your real asset loader (R2, KV, fetch, and so on).
	return { body: new ArrayBuffer(0), encoding: "br" };
}

async function loadGzip(request) {
	return { body: new ArrayBuffer(0), encoding: "gzip" };
}

import { WorkerEntrypoint } from "cloudflare:workers";

export class CachedAssets extends WorkerEntrypoint {
	async fetch(request: Request): Promise<Response> {
		const accept = request.headers.get("Accept-Encoding") ?? "";
		const wantsBrotli = accept.includes("br");

		const { body, encoding } = wantsBrotli
			? await loadBrotli(request)
			: await loadGzip(request);

		return new Response(body, {
			headers: {
				"Content-Type": "application/javascript",
				"Content-Encoding": encoding,
				"Cache-Control": "public, max-age=86400, immutable",
				// One variant per distinct Accept-Encoding value the cached
				// entrypoint sees. The gateway below normalizes that value.
				Vary: "Accept-Encoding",
			},
		});
	}
}

export default {
	async fetch(request, env, ctx): Promise<Response> {
		// On Cloudflare, the eyeball's Accept-Encoding is usually rewritten
		// to a canonical value before the Worker runs. Restore it from
		// request.cf.clientAcceptEncoding so the cached entrypoint sees
		// what the client actually sent — and so Vary keys variants on
		// the real value.
		const original = request.cf?.clientAcceptEncoding;

		const forwarded = new Request(request);
		if (original) {
			forwarded.headers.set("Accept-Encoding", original);
		}

		// The gateway's cache is disabled (see the Wrangler configuration
		// above), so it runs on every request and always restores
		// Accept-Encoding before forwarding to the cached entrypoint.
		return ctx.exports.CachedAssets.fetch(forwarded);
	},
} satisfies ExportedHandler;

async function loadBrotli(
	request: Request,
): Promise<{ body: ArrayBuffer; encoding: string }> {
	// Replace with your real asset loader (R2, KV, fetch, and so on).
	return { body: new ArrayBuffer(0), encoding: "br" };
}

async function loadGzip(
	request: Request,
): Promise<{ body: ArrayBuffer; encoding: string }> {
	return { body: new ArrayBuffer(0), encoding: "gzip" };
}

import { DurableObject, WorkerEntrypoint } from "cloudflare:workers";

// A Durable Object that maintains an expensive-to-compute leaderboard.
export class Leaderboard extends DurableObject {
	async fetch(request) {
		const url = new URL(request.url);

		if (url.pathname === "/top") {
			const top = await this.computeTop();
			return new Response(JSON.stringify(top), {
				headers: { "Content-Type": "application/json" },
			});
		}

		if (url.pathname === "/record" && request.method === "POST") {
			const { userId, score } = await request.json();
			await this.record(userId, score);
			return new Response("Recorded");
		}

		return new Response("Not found", { status: 404 });
	}

	async computeTop() {
		// Pretend this is expensive — a sorted scan of stored state, an
		// aggregation across many keys, a call to another service.
		return { top: [], computedAt: Date.now() };
	}

	async record(userId, score) {
		await this.ctx.storage.put(`score:${userId}`, score);
	}
}

// Cached entrypoint. Forwards GET /top to the Durable Object and tags
// the response so it can be purged when scores change.
export class CachedLeaderboard extends WorkerEntrypoint {
	async fetch(request) {
		const id = this.env.LEADERBOARD.idFromName("global");
		const stub = this.env.LEADERBOARD.get(id);
		const response = await stub.fetch(request);

		// Copy the body and headers into a new Response so we can attach
		// cache headers. The DO's body stream is consumed once here.
		return new Response(response.body, {
			status: response.status,
			headers: {
				...Object.fromEntries(response.headers),
				"Cache-Control": "public, max-age=30",
				"Cache-Tag": "leaderboard",
			},
		});
	}

	// Invalidate this entrypoint's cached leaderboard. purge() is scoped to
	// the entrypoint that calls it, so it must run inside CachedLeaderboard —
	// the entrypoint that owns the cached response. The gateway invokes this
	// over ctx.exports after a write.
	async invalidate() {
		await this.ctx.cache.purge({ tags: ["leaderboard"] });
	}
}

// Default entrypoint. Routes reads through the cached entrypoint
// and writes directly to the Durable Object, invalidating the cache on write.
export default {
	async fetch(request, env, ctx) {
		const url = new URL(request.url);

		if (request.method === "GET" && url.pathname === "/top") {
			// Read path — goes through Workers Caching. The router's cache is
			// disabled (see the Wrangler configuration above), so it runs on
			// every request. On a hit, CachedLeaderboard never runs and the
			// Durable Object is never touched.
			return ctx.exports.CachedLeaderboard.fetch(request);
		}

		if (request.method === "POST" && url.pathname === "/record") {
			// Write path — bypass the cached entrypoint, hit the Durable
			// Object directly, then ask CachedLeaderboard to invalidate its
			// own cache so the next read returns fresh data. The purge must
			// run inside CachedLeaderboard because purges are scoped to the
			// entrypoint that owns the cached response — a purge from this
			// gateway would target the gateway's (disabled) cache instead.
			const id = env.LEADERBOARD.idFromName("global");
			const stub = env.LEADERBOARD.get(id);
			const result = await stub.fetch(request);

			await ctx.exports.CachedLeaderboard.invalidate();

			return result;
		}

		return new Response("Not found", { status: 404 });
	},
};

import { DurableObject, WorkerEntrypoint } from "cloudflare:workers";

interface Env {
	LEADERBOARD: DurableObjectNamespace<Leaderboard>;
}

// A Durable Object that maintains an expensive-to-compute leaderboard.
export class