Skip to main content

migration / Checked 2026-10-18

Move end-user authentication connections from Cloudflare Browser Run to Notte

A migration plan for end-user authentication connections: retain the business check, replace Cloudflare Browser Run's provider-owned resources, and prove the Notte workflow before cutover.

Decide whether this move earns its cost

A customer authorizes an application to operate an existing website account. The application must distinguish a usable connection from a browser that merely started.

Cloudflare can be an economical architectural choice when Workers and the surrounding scheduling already exist in your application. Notte is worth evaluating when a browser, deployed Python handler and authentication workflow should share a product rather than a Workers composition.

Notte Managed Auth is relevant when a saved website connection and its readiness check should precede browser execution. A profile and a credential vault remain distinct resources.

Another provider's managed-auth flow can be the better fit when it already supports the application's consent and handoff experience. Confirm supported websites and the actual user path rather than comparing the feature name.

Keep the result contract stable

A consenting test user, the intended website account and an application-owned connection mapping.

The task waits for a usable connection and verifies the expected account before taking an action on the customer's behalf.

Preserve the evidence contract across the move: Consenting application user, intended account, connection reference and readiness outcome.

Map the workflow's resources

RequirementCloudflare Browser RunNotte
Saved browser stateSession reuse / custom stateDocumented
Credential handlingApplication-ownedDocumented
Website sign-inNot establishedDocumented

Sources: developers.cloudflare.com [1] ↗docs.notte.cc [2] ↗docs.notte.cc [3] ↗

Website login

Cloudflare Browser Run: Use browser code to implement the website's sign-in flow and retain the necessary session state. The reviewed overview does not establish a managed website connection that checks sign-in readiness before a workflow starts.

Notte: Vaults substitute credential placeholders in supported browser actions outside the model context. Managed Auth checks requested saved connections before automation. Personas supply an inbox and optional phone number for verification workflows.

Sources: developers.cloudflare.com [1] ↗docs.notte.cc [2] ↗

What survives a session

Cloudflare Browser Run: Cloudflare documents reuse of browser sessions and a Durable Objects integration. Keeping a session alive is different from exporting a portable authenticated profile; design the required state store explicitly.

Notte: Profiles save cookies, local storage and session storage. Sessions start with fresh state by default. Persisting a profile writes state back when the session ends; a running session can also save its state explicitly.

Sources: developers.cloudflare.com [1] ↗docs.notte.cc [2] ↗

Pricing model

Cloudflare Browser Run: Price browser usage and the Worker execution components required by the workload. The Browser Run pricing page, rather than a single browser-hour estimate, defines included allowances and applicable limits.

Notte: The public usage rates are $0.01 per browser-hour, $0.05 per Function-hour and $10 per GB of managed proxy traffic. Paid plans return their price as usage credits. Price the relevant meters and plan eligibility for the workload.

Sources: developers.cloudflare.com [1] ↗notte.cc [2] ↗

Cut over one responsibility at a time

For this Cloudflare Browser Run-to-Notte migration, keep the business assertion outside provider resource management. Source profile, connection, file and execution IDs are not valid target IDs; use a documented transfer path or establish the corresponding resource in Notte.

Retain source job history and a rollback route until the target pilot passes. A migration checklist is not evidence that saved state or runtime behavior is automatically portable.

  • Inventory the source connection's owner and the actions the user authorized.
  • Create a target connection through an authorized user flow instead of copying provider-owned IDs.
  • Verify readiness, account identity and the user handoff before moving customer tasks.

Sources: developers.cloudflare.com [1] ↗docs.notte.cc [2] ↗docs.notte.cc [3] ↗

A proposed acceptance case

This is an evaluation design, not a claim that this workflow has been executed successfully on every provider.

Part of the testRequired observation
Controlled inputA consenting test user, the intended website account and an application-owned connection mapping.
Pass conditionThe task waits for a usable connection and verifies the expected account before taking an action on the customer's behalf.
Negative caseStart a test with a connection that is not ready. The browser workflow must stop or request the required user step rather than acting in an anonymous or different account.
Evidence to retainConsenting application user, intended account, connection reference and readiness outcome.

A reason to delay or keep the source

Start a test with a connection that is not ready. The browser workflow must stop or request the required user step rather than acting in an anonymous or different account.

Cloudflare Browser Run: A Worker and a browser session have separate resource and lifecycle constraints. Confirm the chosen browser library and binding path instead of assuming an unchanged local browser script will deploy directly.

Delay cutover when the target's selected plan, required artifact path or supported website-account flow is not established. Resolve that gap before moving real jobs, even if the rate comparison favors the target.

Sources: developers.cloudflare.com [1] ↗notte.cc [2] ↗

Keep comparing

Put the workflow to the test.

Try Notte Read the quickstart ↗