Agents can now go from zero to production on Cloudflare without a human in the loop

Deploying to production used to be a multi-stop trip: create an account, enter a credit card, generate an API token, copy it into the right config, and only then point your agent at the infrastructure. Cloudflare and Stripe are changing that. A new protocol co-designed by the two companies lets coding agents provision a Cloudflare account, start a paid subscription, register a domain, and receive an API token — all without a human touching the dashboard.

The flow relies on Stripe’s identity and billing layer as the trust anchor. A user signs in to Stripe once; from there, an agent can discover available services, provision resources, and get billed, with the human only stepping in to approve the initial grant and accept Cloudflare’s terms of service. No copying tokens, no credit card entry, no pre-configured integrations. The agent also benefits from Cloudflare’s Code Mode MCP server and Agent Skills once it has access.

Cloudflare is also extending $100,000 in Cloudflare credits to startups that incorporate through Stripe Atlas. But the protocol itself is not exclusive to Stripe — any platform with signed-in users can play the same orchestrator role.

The zero-to-production runbook

Getting started requires the Stripe CLI with the Stripe Projects plugin. After logging in to Stripe and starting a new project, the user can simply prompt their agent to build and deploy to a new domain.

The OAuth and account-provisioning logic handles both cases out of the box:

  • Existing Cloudflare account: The user gets a standard OAuth prompt to grant the Stripe Projects CLI access.
  • No existing account: If the email attached to the Stripe login has no Cloudflare account, Cloudflare provisions one automatically — with no signup page involved.

The agent will pause for input only when truly necessary, such as when the Stripe account has no linked payment method. At the end of the run, the agent has provisioned a new Cloudflare account, obtained an API token, purchased a domain, and deployed an application to production.

Three pillars: discovery, authorization, payment

The integration rests on three components that let an agent act autonomously rather than following a scripted human workflow:

  • Discovery — The agent can query a catalog of available services using a CLI command like stripe projects catalog, which returns the available providers and their resources in JSON.
  • Authorization — The platform (Stripe) attests to the user’s identity. Cloudflare then either links the existing account via OAuth or creates a new one on the spot, and securely issues credentials back to the Stripe Projects CLI for the agent to use.
  • Payment — Stripe sends a payment token to the provider as part of the provisioning request. Raw credit card details never reach the agent or the CLI.

The design builds on existing standards — OAuth, OIDC, and payment tokenization — but combines them in a way that removes the manual steps those standards were never designed to eliminate on their own. The protocol treats agents as a first-class consumer of cloud services, not as a special case bolted onto a human-first workflow.

This is a meaningful step for agent-driven development. An agent given a high-level task — "build me a site and put it on a domain" — can now discover that Cloudflare Registrar is an option, provision the account, handle the purchase, and deploy, all through API calls the agent chooses to make. The user doesn’t need to know what services exist or how to wire them together.

Spending limits keep agents on a short leash

Trusting an agent with a credit card is a reasonable cause for concern. The protocol addresses this with a two-layer control:

  • Default cap: Stripe enforces a $100.00 USD/month limit on what an agent can spend with any single provider.
  • Budget alerts: Users who want to raise the ceiling can set Budget Alerts on their Cloudflare account for ongoing visibility.

Payment tokens are attached to each provisioning request, so the provider can bill the customer directly while the agent never sees the underlying payment instrument.

A pattern other platforms can adopt

The protocol is not locked to Stripe. Any platform with authenticated users — a coding agent product, a dev tool, a CI/CD service — can act as the orchestrator. When a user needs a domain, a storage bucket, a sandbox, or any other Cloudflare resource, the platform makes a single API call to provision an account and gets back a token for authenticated requests on the user's behalf.

The reverse direction is also possible. Cloudflare itself has been working with Planetscale on a similar flow that lets Cloudflare users create Planetscale Postgres databases directly from Cloudflare, with billing tied to the existing payment method on file. In that arrangement, Cloudflare acts as the orchestrator and Planetscale as the provider.

Cloudflare is positioning this as a step toward standardizing cross-product integrations that have historically been bespoke one-offs. The company says it will share a more official specification with Stripe soon, and is inviting other platforms to contac them at [email protected] to discuss integration.

Getting started

Stripe Projects is in open beta. Users don't need an existing Cloudflare account to try it — just install the Stripe CLI, log in, and launch a new project. From there, the agent handles the rest of the journey from idea to deployed app on a fresh domain.