How I built a $0/month AI SaaS on Cloudflare (Pages + Workers AI + KV)

The goal
I wanted to ship a real SaaS product — one that calls an LLM, takes money, has auth, and reaches a global audience — without spinning up a server, managing a database, or paying infra bills before I had a single customer.
So I built ReThread (an AI tool that turns one technical blog post into 7 platform-native formats) entirely on Cloudflare's free tiers. This post is the architecture, the tradeoffs, and what I'd tell you if you're building something similar.
The whole stack on one platform
No servers, no Docker, no separate API host. Everything lives in one Cloudflare project:
┌──────────────────────────────────────────────┐
│ Cloudflare Pages project │
│ │
│ public/ → static frontend (HTML/JS) │
│ functions/ → serverless API endpoints │
│ │
│ Bindings: │
│ AI → Workers AI (Llama 3.3 70B) │
│ WAITLIST → KV (key-value store) │
└──────────────────────────────────────────────┘
│ │
Creem (payments) Global edge (300+ cities)
One wrangler pages deploy ships the frontend AND the API together. That alone removed most of the usual "wire up a backend" yak-shaving.
The pieces that do the real work

1. Pages Functions as the API Each file in functions/ is an endpoint. functions/repurpose.js exports an onRequestPost that takes the user's post, calls the LLM, and returns the formats you asked for. No framework, no Express — just a function per route. This is what surprised me most: the "backend" is just a folder of files that deploys alongside the static site.
2. Workers AI for inference The LLM call is a single binding — no API keys, no separate provider account: const result = await env.AI.run( "@cf/meta/llama-3.3-70b-instruct-fp8-fast", { messages: [ /* ... */ ] } ); It runs on Cloudflare's GPUs at the edge, so a user in São Paulo and a user in Berlin both hit a nearby node. The free tier has a daily allocation that's plenty at low volume — no credit card required. (Swappable: if you ever want GPT-4-class quality, the same code path can call OpenAI/DeepSeek via an env var.)
3. KV as the entire "database" No Postgres, no Redis. KV holds:
4. Entitlements — who paid, what plan, active/refunded
5. Sessions — passwordless login tokens (7-day TTL)
6. License keys — the key → email mapping
7. Rate-limit counters — per-user daily usage, charged before the model runs
8. Page-view counters — referrer attribution, so I know which channel sent traffic KV is a globally-replicated key-value store. Reads are fast everywhere; writes are eventually consistent (usually under a minute to propagate). For entitlements and counters that's totally fine. I would NOT use it for anything needing strong consistency (inventory, ledgers). Update (Oct 2026): the paid path described in the next two sections is switched off. ReThread is free during the beta — no card, no paid plan. The code is still there (webhook, license keys, entitlement checks), just unused. I left these sections in because the HMAC and event de-duplication pattern is the part actually worth reading.
9. Passwordless auth + a license key Two ways to unlock the paid tier:
10. License key: Creem emails the buyer a key on purchase; they paste it in the app. The webhook stores key → {email, plan} in KV.
11. Email fallback: the webhook already verified the payment, so the purchase email unlocks Pro directly. Sessions are a random UUID stored in KV with a 7-day TTL — no password table, no bcrypt, no reset-flow emails. And entitlement is re-checked on every request, so a refund or cancel instantly revokes access (no "you still have Pro for 7 days" loophole). One detail worth borrowing: the API never trusts an email in the request body. Identity comes from the session token, and the body's email is only used as a display label. Otherwise anyone can spend someone else's quota by typing their address.
12. Verifying the payment webhook Creem hits /webhook on every purchase/refund. I verify the HMAC-SHA256 signature before trusting anything, and de-dupe by event ID in KV so a redelivered event can't double-grant. Then it's a simple KV write to flip the entitlement. What it actually costs Service Free tier Cost at my volume Pages + Functions Unlimited requests, 500 builds/mo $0 Workers AI Daily free allocation $0 KV ~100k reads / 1k writes per day $0 Creem — n/a during beta (paid tier off) Total: $0/month — and it stayed $0 with zero users, which is the whole point. The first bill only shows up after there is real traffic, and that is exactly the order you want. (Free-tier numbers change; check Cloudflare's current limits. But the shape holds: you get a lot for free.) Tradeoffs / what I'd tell you
13. KV's eventual consistency is the main gotcha — don't build anything that needs read-after-write guarantees across regions.
14. Workers have limits (CPU time, subrequests). Fine for API endpoints; don't try to run a video transcode.
15. There is a 100-second gateway timeout, and it is closer than you think. A 7-format run takes about 100 seconds of model time in total, so firing all 7 requests in parallel reliably returns a 524 — after the quota has already been charged. The fix was boring: the frontend sends three batches and stitches the results. Now the worst batch is about 40 seconds. I shipped the broken version first.
16. Plan for the free allocation running out. My global cap is 150 model calls a day, so on a good day the demo says "at capacity, come back tomorrow" instead of throwing random per-request errors. Degrading on purpose beats failing by accident.
17. One platform = one blast radius. If Cloudflare has a bad day, your whole stack is down. Acceptable for a side project; for something mission-critical I'd diversify.
18. The DX is genuinely great. wrangler pages deploy and you're live globally. I shipped this in a weekend of evenings. The product, if you're curious ReThread → https://feijihua.top — turn one technical post into 7 formats without mangling your code. Free during the beta: 10 full runs a day with an email, no card, brand-voice matching included. Built it partly to scratch my own itch and partly to prove you can ship a real AI SaaS — payments wired end to end, auth, quota, webhooks — without paying for infrastructure. Happy to answer questions in the comments — especially if you're building something similar on Workers.