Can built-in Gatekeepers be enabled with the official one-click deployment?

[Tmeister]

Hi,

When deploying Cloudflare OS through the official Deploy to your Cloudflare account flow, can we enable built-in Gatekeepers such as:

• Google
• Slack
• etc

If yes, how should they be enabled and configured?

I haven’t been able to find documentation covering this specific setup. Any guidance would be appreciated.

Thanks!

[Ashutosh0x]

The built-in gatekeepers (GitHub, Google, Slack, etc.) are included in the source tree under packages/gatekeeper-*, but the one-click "Deploy to Cloudflare" flow only provisions the core infrastructure (router, workshop backend/frontend, MCP shared). The gatekeepers require per-tenant OAuth client credentials (client ID + secret) that you register with each upstream provider (Google Cloud Console, GitHub OAuth Apps, etc.).

To enable a gatekeeper after deploying:

1. Register an OAuth app with the upstream provider (e.g., Google Cloud Console for Google, GitHub Developer Settings for GitHub)
2. Set the redirect URI to your deployment's callback URL (pattern: https://<your-domain>/oauth/<provider>/callback)
3. Add the client credentials as Wrangler secrets:

   wrangler secret put GOOGLE_CLIENT_ID
   wrangler secret put GOOGLE_CLIENT_SECRET

4. The gatekeeper's Durable Object binding in wrangler.jsonc handles the rest ? the router dispatches to the correct gatekeeper class based on the resource URL pattern

The wrangler.jsonc at the repo root already declares all the DO bindings; they just need the secrets populated. Each gatekeeper's src/*.ts file documents the expected environment bindings near the top.

One caveat: if you're self-hosting with workerd rather than Cloudflare Workers, you'll need to configure the equivalent secrets in your local wrangler.toml or environment variables.