Map background, network, and AI products

The previous lesson mapped compute and storage. This one covers the products that work outside the request-response cycle, at the network boundary, and around AI models.

Background work

Queues buffer and deliver messages. A producer Worker sends a message during a request; a consumer Worker processes it later, with retries and batching. Reach for a queue when work must survive the request that created it — sending email, syncing a third-party system, resizing an upload.

Workflows persist multi-step execution. Where a queue delivers one message, a Workflow remembers which steps of a long job already completed, so a crash resumes instead of restarting. Multi-day onboarding sequences and multi-step pipelines fit here.

A queue producer is just another binding:

{
  "queues": {
    "producers": [{ "binding": "EMAIL_QUEUE", "queue": "email-jobs" }]
  }
}

The network boundary

Tunnel connects origins and private networks outward to Cloudflare. The connector on your machine dials out, so no inbound firewall port opens. Turnstile protects public forms from bots: the browser widget produces a challenge token, and your server must verify that token before doing the protected work.

const result = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {
  method: 'POST',
  body: new URLSearchParams({ secret: env.TURNSTILE_SECRET, response: token }),
})

Skipping the server-side verification is the common Turnstile mistake. A bot can POST to your endpoint directly and never render the widget.

The AI products

Workers AI runs models on Cloudflare’s GPUs through a binding. Vectorize stores and searches embeddings for retrieval. AI Gateway sits in front of model calls — yours or a third party’s — and adds caching, rate limits, spend visibility, and logs. Agents SDK builds stateful, real-time agents on top of Durable Objects.

These products compose: a Worker calls Workers AI through AI Gateway and searches Vectorize for context. But composition should follow a concrete need rather than a desire to use every binding. Every product you add is another thing to secure, monitor, and pay for.

Now sketch one application you know well and select the smallest set of products that gives it the required behavior. For each product you include, write the requirement that forced it in.