Recipe 05 · Choose your ingredients
Cloudflare Workers + TypeScript
For a small hosted API without managing a traditional server.
Learn by building: Open the guided GRC project lesson for this stack.
Each recipe uses the same learning path: understand the ingredients, follow one realistic example, build a small first version, test failure cases, then decide whether to add more. You do not need every ingredient on day one.
All five recipes · Jump to a recipe
When to choose this
What problem does it solve?
A lightweight public interface or controlled intake workflow that needs a few trusted server-side operations.
Try the simpler option first: Start with GitHub Pages or Cloudflare Pages alone if no trusted server operation is required.
New to the terminology? Start with What Is a Technology Stack? or follow the browser-to-server diagram.
Under the hood
Meet the ingredients
HTML/CSS/JavaScript or a static frontend on Cloudflare Pages
TypeScript functions on Cloudflare Workers
No database for stateless operations; D1 when structured shared records are needed
GitHub
Why it works with AI-assisted coding: Small functions and typed inputs can be reviewed and tested independently with AI assistance, without introducing a large application framework.
See the stack in action
One project, from input to result
Goal: Accept a fictional exception request
A control ID, reason, and review date submitted from a form
A Worker validates JSON and returns a response; TypeScript describes inputs; D1 is optional
A confirmation or useful validation error
Your first working milestone
One Worker endpoint with synthetic inputs and no database
A valid request returns a structured confirmation
Invalid inputs return 4xx errors and duplicates are handled deliberately
Only then consider: Add authentication, abuse controls, and D1 only for durable shared requests
Three GRC ideas
What could you build?
- Exception intake portal with fictional requests
- Control owner directory with controlled updates
- Webhook-based evidence event monitor
Your first version
Build a little, test a little
- Create a static form with synthetic submissions.
- Identify which operation must run on a trusted server.
- Add one Worker endpoint with input validation and explicit error responses.
- Introduce D1 only for persistent shared records, then test permissions, retries, and duplicate submissions.
Where it runs: Cloudflare Pages can serve the frontend and Workers can run the API. D1 is an optional managed SQL database; R2 is a separate option for objects. Compare costs, limits, observability, and portability against AWS Lambda/API Gateway and related storage services.
Ask AI, then decide
A prompt worth trying
I am considering a Cloudflare Worker for a small GRC intake tool. Explain what can stay static, what needs a trusted server, whether D1 is necessary, and how to test unauthorized requests and duplicate submissions.
Review the recommendation against your Playbook blueprint. Ask what can be removed, what could go wrong, and how you will test it.