Show HN: Cfswitch – Switch between multiple Cloudflare accounts in Wrangler

Cfswitch, a new CLI tool, enables seamless switching between multiple Cloudflare accounts in Wrangler by using named auth profiles injected as environment variables. Built for AI agents and CI pipelines, it eliminates the need for repeated logout/login steps during deployments. The tool is fully non-interactive, has no runtime dependencies, and supports commands like wizard, add, and wrangler execution.

Switch Cloudflare / wrangler auth between multiple accounts. Built for AI agents and CI first, humans second. wrangler login only holds one OAuth session at a time. If you or your coding agent juggle several Cloudflare accounts, every deploy becomes a logout/login dance. cfswitch fixes this with named auth profiles injected as environment variables CLOUDFLARE API TOKEN / CLOUDFLARE ACCOUNT ID , which wrangler always honors over its OAuth login, per Cloudflare's docs https://developers.cloudflare.com/workers/wrangler/system-environment-variables/ . Design rules: - It never prompts. Every command is fully non-interactive, so any agent, script, or CI job can run it safely. - No runtime dependencies. One bundled file, Node ≥ 18, so npx cfswitch-cli runs without installing anything. --json on every read command, clean exit codes, errors on stderr.- Token values are only ever printed by cfswitch env , whose whole job is printing them. npm install -g cfswitch-cli installs the cfswitch command or: bun add -g cfswitch-cli or zero-install: npx cfswitch-cli help cfswitch wizard This opens the Cloudflare dashboard with a pre-filled token Workers, Pages, KV, R2, D1, routes and watches your clipboard. You log in and click Continue to summary, Create Token, then Copy. The moment the token hits your clipboard, cfswitch verifies it, looks up which accounts it can reach, and saves a pinned profile for each. Switch dashboard accounts and repeat; Ctrl-C when done. Use cfswitch wizard --print-url if you just want the pre-filled URL say, to open on another machine . Create an API token for each account at dash.cloudflare.com/profile/api-tokens https://dash.cloudflare.com/profile/api-tokens the "Edit Cloudflare Workers" template covers Workers + Pages deploys . Then: add profiles token via flag, stdin, or CFSWITCH TOKEN env; never a prompt cfswitch add personal --token cf xxx --account-id 6f9x... echo "$WORK TOKEN" | cfswitch add work --token-stdin sanity-check them against the Cloudflare API cfswitch verify work cfswitch accounts work list account IDs this token can reach run wrangler as any account, from any directory cfswitch wrangler -p personal whoami cfswitch wrangler -p work deploy cfswitch wrangler -p work pages deploy out or set a default and stop passing -p cfswitch use work cfswitch wrangler d1 list | Command | What it does | |---|---| wizard --name <s --print-url --no-browser | Guided setup: pre-filled dashboard URL + clipboard watch, then auto-created pinned profiles. | add <name --token <T --account-id <ID --note <s | Save/update a token profile. Also accepts --token-stdin or $CFSWITCH TOKEN . | login <name | OAuth alternative: runs wrangler login inside an isolated config dir, so multiple OAuth sessions coexist. | list --json | List profiles. Tokens are never shown. | use <name | Set the default profile. | current --json | Show the active profile and where it came from. | remove <name | Delete a profile and its isolated OAuth state, if any . | verify <name --json | Check the token against /user/tokens/verify falls back to the account-scoped endpoint for account-owned tokens . Exit 1 if invalid. | accounts <name --json | List account IDs the token can access; use this to find the right --account-id . | env <name --json | Print export lines: eval "$ cfswitch env work " . | exec -p <name -- <cmd args… | Run any command with the profile's env injected wrangler, terraform, curl, … . | wrangler -p <name args… | Run wrangler as the profile. Resolves local node modules/.bin/wrangler , then PATH, then npx wrangler . | Profile resolution for commands that take an optional name: explicit arg / -p , then the $CFSWITCH PROFILE env var, then the default set via use . The env var lets you pin an agent session or CI job to one account. Rewriting wrangler's global OAuth state ~/.config/.wrangler/config/default.toml to "switch" accounts is racy: two concurrent agents would fight over one global file, and newer wrangler versions move OAuth creds into the OS keychain. Environment-variable injection is Cloudflare's documented CI path, is stateless per-process, and lets any number of concurrent processes each use a different account safely. If you really want OAuth e.g. no permission to create API tokens , cfswitch login <name gives each profile its own XDG CONFIG HOME with CLOUDFLARE AUTH USE KEYRING=false , so sessions live side by side and never clobber your real wrangler login. - Profiles live in ~/.config/cfswitch/profiles.json , created 0600 in a 0700 dir. - Prefer scoped tokens per-account, minimum permissions, optional TTL/IP filters over the Global API Key. list , current , verify , and accounts never output token values; only env does, and only because that's its job. There are three ways to teach an agent about cfswitch. Pick one. This repo is its own plugin marketplace: /plugin marketplace add dukeeagle/cfswitch /plugin install cfswitch@cfswitch The skill ships in skills/cfswitch/ /dukeeagle/cfswitch/blob/main/skills/cfswitch/SKILL.md and tells agents when and how to use cfswitch: ./install-skill.sh symlinks into ~/.agents/skills hub, read by Cursor ; ~/.claude/skills and ~/.codex/skills chain through it ./install-skill.sh --copy copy instead of symlink survives deleting this repo ./install-skill.sh --uninstall The installer never clobbers an existing real directory at any of those paths, and re-running it is idempotent. AGENTS.md /dukeeagle/cfswitch/blob/main/AGENTS.md is a compact, copy-pasteable ruleset. Drop it into your project, or point your agent at npx cfswitch-cli help , which is written to be sufficient on its own. cfman https://github.com/novincode/cfman had the core idea first: store named tokens, inject them as env vars. cfswitch rebuilds that idea for agents, adding JSON output, exec / env primitives, the token wizard, isolated OAuth profiles, and a no-prompts guarantee. MIT