Setup uses two Cloudflare approvals.

First approval: Ankka installs a temporary setup version of your gateway Worker in your Cloudflare account. You review your configuration on that Worker.

Second approval: Your Worker uses the configuration you reviewed to finish installing the gateway, MCP Portal, Access policies, and DNS in your account.

Management token: Setup requires you to create an account API token. Your gateway uses it to update Cloudflare MCP Portals and Access policies directly when you add sources or manage Team access. You enter the token into your own gateway, which saves it as an encrypted Worker secret; it never passes through Ankka. Its Access: Apps and Policies Edit and MCP Portals Edit permissions apply across your Cloudflare account, including resources outside this gateway.

This installer keeps the initial deployment and available domain list for one hour, plus short-lived approval material for your gateway’s one-time key. Your Worker sends its configuration here to certify the callback address. It stores no Cloudflare token and sends no analytics.

You can also deploy from the public source repository.