ArrivlYour site is already on Cloudflare.
One authorization from full visibility.
Enter your domain, approve the authorization on Cloudflare's own consent screen, and Arrivl deploys the tracking in your account — including turning off the edge settings that silently block AI crawlers. About 30 seconds, nothing to install.
We never see your Cloudflare password, and the authorization is scoped to exactly what the deploy needs. Disconnect removes everything we added.
Install guide
Install Cloudflare, start to finish
Cloudflare is the fastest way to install Arrivl: no code, no DNS records to copy, no theme changes. You authorize Arrivl through Cloudflare's official OAuth flow and we deploy the tracking into your own Cloudflare account. Because the measurement runs at your edge, it records AI crawlers that never execute JavaScript. This page covers what that authorization grants, what we put in your account, and how to undo it.
01Install guide
How setup works
Enter your domain
In the Arrivl setup wizard, choose Cloudflare and type the domain you want to measure. We check that the domain is on Cloudflare before sending you anywhere.
Approve the authorization on Cloudflare
Cloudflare shows you its own consent screen listing the permissions below. You approve it on Cloudflare's site, not ours — we never see or store your Cloudflare password, and the connection is scoped to the permissions on that screen.
We deploy, then hand you back
Arrivl uses the authorization to install the tracking Worker in your account, bind it to your domain, and switch off the edge settings that block AI crawlers. It takes about 30 seconds and finishes inside the wizard — nothing to do in the Cloudflare dashboard.
02Install guide
What you're authorizing
workers-scripts.writewrite- Upload the Arrivl tracking Worker to your Cloudflare account. It is the only script we create, and it is named arrivl-tracker.
workers-routes.writewrite- Bind that Worker to your domain's route so requests pass through it. Without the route the Worker exists but sees nothing.
zone.readread- Find which of your zones matches the domain you entered. Read-only, and only to resolve the zone id.
bot-management.readread- Check whether Cloudflare's AI-crawler blocking (Block AI Scrapers, Bot Fight Mode) is on for that zone.
bot-management.writewrite- Turn that blocking off for the zone — Cloudflare blocks GPTBot and friends at the edge by default, so with it on there is nothing to measure. We only change it after the route is bound, never before.
zone-settings.readread- Check whether Browser Integrity Check is on for that zone.
zone-settings.writewrite- Turn Browser Integrity Check off. It 403s known AI crawler user-agents before they reach your site.
dns.readread- See whether your domain's DNS record is proxied through Cloudflare. An unproxied (grey-cloud) record bypasses the Worker entirely.
dns.writewrite- Switch a grey-cloud record to proxied — only when you explicitly click to fix it. Setup never changes DNS on its own, and the change auto-reverts if your site regresses.
offline_accesstoken- Issue a refresh token so we can update or repair the Worker later without sending you through authorization again.
03Install guide
What lands in your account
Exactly one Worker, named arrivl-tracker, plus one route binding it to your domain. The Worker passes every request straight through to your existing origin and reports the request server-side to Arrivl — it does not rewrite your pages, inject scripts, or sit in front of your checkout. Alongside it we turn off three Cloudflare settings that block AI crawlers at the edge: Block AI Scrapers, Bot Fight Mode, and Browser Integrity Check. We only touch those after the route is bound, so your edge security is never lowered for an install that isn't going to work.
04Install guide
How to undo it
Disconnect from Arrivl (Settings → your project → Disconnect) and we remove the route, delete the arrivl-tracker Worker, revoke our own access token at Cloudflare, and drop the stored credentials on our side. Your site keeps serving exactly as before — the Worker was a pass-through, so removing it changes nothing your visitors see. You can also revoke the authorization directly from your Cloudflare dashboard under Manage Account → Authorized Applications, which cuts our access immediately; run the Arrivl disconnect too so the Worker itself is cleaned up.
01Does Arrivl get access to my whole Cloudflare account?
No. The authorization is limited to the scopes listed above: deploying and routing one Worker, reading your zone, and toggling the three AI-blocking settings. There is no access to your billing, your other Workers, your certificates, or your account members. Cloudflare enforces the scope list — anything outside it is refused at their API, not just avoided by us.
02What exactly gets deployed to my site?
One Worker named arrivl-tracker and one route pointing your domain at it. The Worker forwards each request to your existing origin unchanged and reports it to Arrivl server-side. No JavaScript is added to your pages, and Cloudflare excludes Workers from Shopify checkout paths, so checkout is never in the path.
03How do I revoke it later?
Disconnect inside Arrivl and we delete the Worker, remove the route, and revoke our token. You can additionally revoke the app from Cloudflare's own Authorized Applications page. Either way your site returns to exactly its prior behaviour; the three bot settings we turned off stay as they are unless you switch them back on.
Values shown as ak_YOUR_WEBSITE_KEY are placeholders. Sign in and the in-dashboard version of this guide fills in your real key and per-project values for you.
Next step