Guides · Cloudflare

Get a Mac notification for Cloudflare alerts, or from a Worker

Cloudflare's notification system can deliver any alert, origin errors, certificate events, usage thresholds, to a webhook destination, and a Worker can POST JSON to a URL from anywhere in your code. Either way the delivery lands in your menu bar with a count.

Needs: the free EventBar app on your Mac, an EventBar account, and a Cloudflare account with permission to add webhooks. About five minutes. Generic JSON.

Steps

Create the webhook URL. In the EventBar dashboard, open the Webhooks tab, pick the group this belongs to (one group per site or app is the usual shape), choose the provider Generic JSON, name it, and press Create. Copy the URL; it stays visible and can be rotated any time.
Paste it into Cloudflare. In the Cloudflare dashboard: pick the account, then Notifications, then Destinations, then under Webhooks press Create. Name it, paste the hook URL, leave Secret empty, and press Save and Test; Cloudflare sends a test delivery straight away. Then Notifications, then Add, choose an alert type and tick the webhook as its destination. Create the EventBar hook as Generic JSON with type field alert_type, so each alert kind gets its own switch, and a default type of cloudflare for the test delivery to land under.
Trigger one. Most services offer a test delivery; otherwise do the real thing once. It shows up in the dashboard's Events tab within a second and in the menu bar, as an undefined type named after the event. That first one is your proof the wiring works.
Make it read well. Press Define on the new type and give it a title and a body template. Fields come from the payload, nested ones with dots. The table below is a starting point.

What you'll see

Type	Title	Body template
`http_alert_origin_error`	Origin errors	`{text}`
`universal_ssl_event_type`	Certificate event	`{name} · {text}`
`health_check_status_notification`	Health check	`{text}`
`signup`	From a Worker	`{text}`

Every type has its own switch in the menu bar, so a noisy one can be quiet on this Mac and still counted. Counts cover the last hour, 24 hours, 7 days, 30 days and all time.

Worth knowing

Every Cloudflare alert carries name, text, ts and alert_type; the per-alert detail sits under data and differs by alert, so check one delivery in the dashboard's Events tab before reaching into it.
The destination's optional secret travels in a cf-webhook-auth header the generic preset doesn't check. The URL is the secret; rotate it from the dashboard if it leaks.
From a Worker, the same hook and the same type field work: await fetch(env.EVENTBAR_HOOK, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ alert_type: "signup", text: email }) }), with the hook URL in a Worker secret rather than in the source.

The full contract, including how each preset reads a payload and what the answers mean, is in the API docs. Something about Cloudflare's payload changed? Tell us and we'll fix the guide.