Cloudflare 401

Widget chat and playground both fail with "Sorry — something went wrong". Tail of storage/logs/laravel.log shows:

Workers AI 401: {"success":false,"error":[{"code":2009,"message":"Unauthorized"}]}

Cloudflare rejected the API token Pitchbar sent on the Workers AI call. This page is the recovery playbook.

Diagnose

Run this curl command from your Pitchbar server, substituting the actual values from your .env or /settings/system → AI:

ACCOUNT_ID="paste-32-char-hex-here"
TOKEN="paste-fresh-token-here"
curl -i -X POST "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/ai/run/@cf/baai/bge-base-en-v1.5" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"text":["hello"]}'

Three possible outcomes:

Response	Cause	Fix
200 + JSON with floats	Cloudflare is fine; Pitchbar is sending a stale cached token from bootstrap/cache/config.php.	php artisan config:clear && php artisan cache:clear && php artisan view:clear
401	Account ID does not match the account this token was issued for, OR Workers AI is not enabled on this account, OR token was mistyped (whitespace, partial paste).	See checklist below.
403	Token is valid for the account but lacks the Workers AI: Read scope.	Re-issue the token with the correct scope. See "Required scopes" below.

401 checklist (in priority order)

1. Confirm CLOUDFLARE_ACCOUNT_ID matches the account that issued the token. Log in to Cloudflare as the same email used to create the token → Workers & Pages → right sidebar → Account ID (32-char hex). Paste that into Pitchbar → Settings → System → AI → Cloudflare. The most common cause of 401 with a fresh token is a mismatched account ID.
2. Confirm Workers AI is enabled on this account. Dashboard → AI → Workers AI. If you see a "Get started" button, click it to enable. Free tier covers most CodeCanyon-scale installs.
3. Regenerate the token cleanly. Dashboard → My Profile → API Tokens → Create Token → Custom token. Use the scopes listed below. Account Resources: "Include → Specific account → your account". Copy the token string with no leading or trailing whitespace, paste into Pitchbar, save.
4. Verify with the verify endpoint.

   curl -i "https://api.cloudflare.com/client/v4/user/tokens/verify" \
     -H "Authorization: Bearer NEW_TOKEN"

   Expected: "status":"active". Confirms the token string itself is valid; doesn't confirm scope.

Required Cloudflare API token scopes

Pitchbar's default Cloudflare stack uses Workers AI for chat + embeddings, Vectorize for retrieval, and Cloudflare Browser Rendering for crawls. The token needs:

Scope	Why
Workers AI: Read	Chat + embedding inference
Vectorize: Write	Index CRUD + query (write implies read)
Browser Rendering: Write	Page crawl for knowledge sources
Workers Scripts: Write	One-click cron worker deploy from /settings/system → Cron worker

Not required: AI Gateway, R2 Storage, Pages. Earlier versions of Pitchbar suggested AI Gateway scope — that hint was misleading and was removed in v1.3.0.

After token works

Pitchbar config caches the token into bootstrap/cache/config.php on first request. After updating the token in /settings/system → AI, you must clear the cache:

php artisan config:clear
php artisan cache:clear
php artisan view:clear

Then retry the playground at /admin/agents/{id}/playground. Should work immediately.