SignalFlare watches your Cloudflare usage every 5 minutes — Workers, R2, KV, D1, Durable Objects — and pings you in Slack the moment spend goes sideways. Days before the invoice.
Read-only API token · 2-minute setup · no card for the trial
Usage-based billing is wonderful until something starts spending on your behalf.
In 2024, a site owner wrote up how Cloudflare sales gave them 24 hours to commit to roughly $120,000, then dropped their domains when they didn't. One side of a messy story, sure. It still sent a lot of people to re-read what they'd agreed to.
Read the HN thread →Workers, R2, KV and D1 bill per use with no ceiling. A retry loop writing to KV at $5 per million writes doesn't stop until you notice. Nothing in the platform will stop it for you.
Cloudflare shipped budget alerts in April 2026: an email, account-wide, PAYG only. No Slack. No per-service rules. No projections. Nothing pauses. Better than silence, but an email about the whole account is not what saves your weekend.
One scope: Account Analytics: Read. We show you exactly where to click.
About 60 seconds, and the token can't modify a thing.
$20 a month? $200? Add per-service rules ("R2 alone crosses $10") and thresholds at 50, 80 and 100%.
Slack, Discord, email or a signed webhook. Including when the projection says you'll blow the budget, not just when you already have.
Analytics-read-only scope. It can't touch DNS, Workers, or settings. We encrypt it with AES-256-GCM at rest, decrypt it only in memory to poll, and never log it. Revoke it in the Cloudflare dashboard any time and we go blind immediately.
The emergency brake: when a hard cap breaches 100%, SignalFlare removes a Worker route or flips on a blocking WAF rule — automatically. Opt-in with a separate write token, born in dry-run mode, armed only after you type the confirmation, every execution audited. Because an alert at 3am is only useful if someone's awake.
Cheaper than the overage it catches. That's the whole pitch.
$0
$19/mo
Custom
Monitoring runs on Cloudflare Workers, naturally. We watch our own bill with SignalFlare.
Close, not exact. Cloudflare samples its analytics, so our dollar figures can drift a few percent from your invoice. That's fine for the job: what you need at 3am is direction and timing (spend doubled in the last hour, you'll cross your cap on Thursday), not cent-level accounting. We label every number in the app as an estimate.
Use both, honestly. But Cloudflare's alerts (shipped April 2026) send an email, cover the whole account in one number, and only work on pay-as-you-go billing. No Slack or webhooks, no per-service rules, no projections. SignalFlare tells you R2 specifically is on fire, in the channel your team actually reads, before the cap is hit rather than after.
The token you give us is analytics-read-only. It cannot change DNS, deploy Workers, or touch settings; the worst a leaked one could do is read usage numbers. We encrypt it with AES-256-GCM at rest, decrypt it only in memory to poll, and never write it to logs. You can revoke it in the Cloudflare dashboard at any time and we're instantly blind.
Workers, R2, KV, D1 and Durable Objects at launch. Queues, Images and Stream are next. If the service that bit you is missing, email us; the polling layer is the same, so adding one is usually quick.
Yes, and that matters more than it sounds. Cloudflare's analytics only retain about 31 days, so by the time you want to compare this month's R2 spend to last month's, the raw data is gone. We keep your history so month-over-month trends survive. Delete your account and the history goes with it.
Yes — if you arm it. The kill switch (auto-remove a Worker route or flip a blocking WAF rule when a hard cap is breached) ships today in early access: opt-in, powered by a separate write token you grant explicitly, born in dry-run mode so you can see exactly what it would have done before you let it do anything, and armed only after a typed confirmation. Every execution is audited.