Set up your Gateway
Install the Gateway in your Cloudflare account and create your owner account. About 15 minutes.
The Gateway is where you and the people you invite sign in and open your apps. Before you start, you need a Cloudflare account on Workers Paid and a domain on Cloudflare.
Using Claude Code, Codex or Cursor? It can run these steps for you. Or let your coding agent do it
Install the tools
-
Node.js. Download the LTS version from nodejs.org and run the installer. You need version 22.18 or newer.
-
A terminal. On a Mac, open the Terminal app. On Windows, open Windows Terminal.
-
pnpm. In the terminal, run:
npm install -g pnpm -
Git. On a Mac, run
git --version. If it isn't installed, your Mac offers to install it. On Windows, install it from git-scm.com.
Set it up
Download EveryApp
git clone https://github.com/every-app/every-app.git
cd every-app
pnpm installRun every command in these docs from this every-app folder.
Start setup
pnpm everyapp setupLog in to Cloudflare
The terminal says Log in to Cloudflare to continue, then Starting Cloudflare's login. Open its link and enter the code. A Cloudflare page opens in your browser. Approve it there. If the page asks for a code, type the one the terminal shows.
If you have more than one Cloudflare account, the terminal asks which one to use.
What you're approving is Cloudflare's own sign-in for its cf command line tool, which EveryApp runs for you. Like wrangler login, it gives cf on this computer broad access to the Cloudflare accounts you belong to, not only the one you pick. EveryApp uses it for the Gateway, your apps and what you turn on later, like Cloudflare Access, and leaves everything else alone; setup stops rather than replace a DNS record that already exists. What EveryApp puts in your account
If you'd rather not grant that, run setup with an API token instead. For setup, a token needs Account > Workers Scripts > Edit, Account > D1 > Edit, Account > Workers KV Storage > Edit, Zone > Zone > Read and Zone > DNS > Read, limited to this account and your domain; set CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID before the command.
Choose your address
The terminal asks for the Gateway address and suggests apps.yourcompany.com. Press Enter to use it, or type another name under your domain. Choosing your address
Wait a few minutes
Setup builds the Gateway and puts it online. This step usually takes 5 to 10 minutes; the whole setup about 15, most of the rest waiting for you at the owner link.
Create your owner account
Your browser opens a page called Set up your gateway. Enter your name, email and a password of at least 8 characters (twice), then select Create owner account.
Back in the terminal, setup asks Configure browser app installs? Yes lets owners and admins install published apps from the Gateway's Admin page instead of the terminal; it asks for a Cloudflare API token (it tells you which permissions) and stores it as a secret on your Gateway, CF_DEPLOY_TOKEN. Press Enter to skip it for now. In a script, add --yes and setup answers No for you. You can turn it on later by running setup again.
Then it asks Put Cloudflare Access in front of your Gateway? Press Enter for Yes: people then sign in at Cloudflare's edge before they reach your Gateway or its apps, with their Cloudflare account or a code sent by email, and Cloudflare's free Zero Trust plan covers 50 people. If your Cloudflare account has no Zero Trust team yet, setup asks for a team name; people sign in at <name>.cloudflareaccess.com, and the name can't be changed later. In a script, or when an agent runs setup for you, Access goes on without a question when it can (your account has a Zero Trust team and your Cloudflare login is an owner or admin of the Gateway); otherwise setup says why and names pnpm everyapp access on. Add --no-access to leave it off. You can turn it off any time with pnpm everyapp access off, and on later with pnpm everyapp access on. Sign in through Cloudflare Access
The owner link works once and expires after about 24 hours. Anyone who opens
it first becomes the owner, so don't share it. If you lose it, run pnpm everyapp setup again for a new one.
Or let your coding agent do it
Paste this into Claude Code, Codex or Cursor and it runs the steps above for you:
Set up EveryApp for me. Docs: https://everyapp.com/llms.txt (read index.md
and setup.md there; the everyapp skill in the repo says the same).
1. Clone https://github.com/every-app/every-app.git, run `pnpm install`,
and run every command from that folder. Always `pnpm everyapp`, never npx.
2. Ask me which domain to use, then run
`pnpm everyapp setup --domain apps.<my domain> --json`.
Setup can run 20 minutes (it builds, deploys, waits for a certificate, then
waits for me at the owner link): give it a long timeout or run it in the
background and read its output.
3. When it is done, create and deploy one app:
`pnpm everyapp create hello --json`, then from apps/hello
`pnpm everyapp deploy --json`. Tell me its URL.
4. Then install the four EveryApp apps unless I say which to skip. Ask me
once: "I'll install OpenSEO, OpenCRM, OpenAnalytics and Agentic Inbox.
Any you don't want?" For each one I keep, run
`pnpm everyapp install https://github.com/every-app/<repo> --json` with
open-seo, open-crm, open-analytics or agentic-inbox as <repo>. If an
install answers NO_RELEASE, say which app and continue; do not try to
build it from source. If it answers R2_NOT_ENABLED, ask me to enable
R2 in the Cloudflare dashboard (once), wait, then run it again. An app
that needs keys shows Needs setup on the Gateway: tell me which keys it
wants and stop there.
The --json output is one event per line. "type":"action_required" means I
have to do something: show me its message, data.url and data.code, then wait
("waiting": true means keep reading, up to 15 minutes). Exit code 2 means
stopped for me: once I say done, run its data.rerun exactly as given (it
already has --json), or one of data.choices[].rerun if I have to pick the
account; if data.needsTerminal is true, give me the command to run myself,
without --json. Exit 1 is an error: show me its code and fix.
Only I can approve the Cloudflare login, pick the Cloudflare account if I
have several, create the owner account from the setup link, pick a
workers.dev name (my apps never use it), pay for Workers Paid, buy a domain,
enable R2 in the dashboard once, or confirm in a terminal a Worker changed
outside everyapp. Keep it short.
When everything is done print DONE and the Gateway URL; if stuck print
BLOCKED: <why> and stop.
It stops where the steps above need you: to approve the Cloudflare login, to pick the Cloudflare account if you have several, to pick a workers.dev name the first time this account runs a Worker (your apps never use it), and to create your owner account. Then it creates and deploys a first app called hello.
When it's done
The terminal ends with your Gateway's address and what to do next:
Gateway https://apps.yourcompany.com
Admin https://apps.yourcompany.com/admin invite people, choose who opens which app
Access on everyone signs in through Cloudflare Access first
Next:
pnpm everyapp create my-app start your first app
pnpm everyapp secret set OPENAI_API_KEY AI for apps (or OPENROUTER_API_KEY, WORKERS_AI_API_TOKEN)
pnpm everyapp secret set EMAIL_FROM EMAIL_FROM_NAME email invites and password resets; needs Cloudflare Email SendingOpen it and you're signed in.
Apps that use AI need a key on your Gateway: OpenAI, OpenRouter or Workers AI. Apps that use AI
Email is optional. With it, invites go out by email. Send email
If you said No to Cloudflare Access, the list also shows pnpm everyapp access on. Before you invite anyone, we strongly recommend it: one command, and people sign in with their Cloudflare account or a code by email before they reach your Gateway. Sign in through Cloudflare Access
If setup stops
Run pnpm everyapp setup again. It picks up where it left off. Troubleshooting covers the common reasons it stops.
Add it to your phone
Open https://apps.yourcompany.com/pwa on your computer and scan the code with your phone, or open that address on your phone and follow the steps. Your apps then open from your home screen.