Let NORG host the mirror for you, or run it on your own Cloudflare account so AI agents get it at your own web address. Same plan, same trial, and you can change your mind either way.
Your AI Retrievability by Norg can live in one of two places. Both publish the same AI-readable copy of your homepage; the difference is whose Cloudflare account serves it, and therefore which web address AI agents see it at.
{your-slug}.agentic.norg.ai from NORG's own Cloudflare account. Nothing is installed on your website, you do not need a Cloudflare account, and your DNS is not changed.switch_hosting. Then pick one of the three install routes below.Neither rule has an off switch.
Both options are the same $99 per month plan with the same 30-day free trial. There is no extra NORG charge for either, and choosing one does not lock you out of the other — you can switch at any time during the trial.
The one cost that is not NORG's: if you self-host and move your Cloudflare account to the Workers Paid plan (see why you might), Cloudflare bills you for that directly.
Create a scoped Cloudflare API token and give it to Claude by calling install_with_cloudflare_token. NORG deploys the worker into your account, creates the route, verifies the install, and keeps pushing worker updates to you from then on. The permissions the token needs are listed on the Cloudflare Worker install guide; the token is stored encrypted and is never shown again.
If your account is on the free Workers plan, or your zone blocks AI bots, Claude will read you a warning first and ask you to confirm before anything is installed.
Be aware: the token is visible in the chat.
Anything you paste into a Claude conversation stays in that conversation. Once Claude confirms the install is live, rotate or revoke the token in Cloudflare.
The honest consequence: revoking it means NORG's stored copy stops working, so automatic worker updates stop and your install behaves like a Deploy-button one. To keep updates, issue a replacement token through the dashboard route below instead of through the chat.
Sign in to the NORG app, open Publishing → CDN & Edge (/publishing/cdn-edge) and paste the same scoped token into the browser form. Nothing enters the Claude conversation. You get the same result as Route 2 — NORG deploys, verifies and keeps the worker updated — without the token ever appearing in a chat transcript.
You can switch at any time during the trial, in either direction, by asking Claude — it uses switch_hosting. Neither direction touches your own website; the only thing that moves is where AI agents are served the mirror from.
When you self-host, the worker runs in your account and sends NORG exactly three things per request, so NORG knows what to render next and can report visit analytics to you:
SITE_ID, so NORG knows which mirror is asking;The full page content of your own site is never sent by the worker, and the worker's request logs stay in your Cloudflare account. NORG never receives a Cloudflare credential from a Deploy-button install; a token you provide through Route 2 or 3 is stored encrypted and used only to deploy, update or remove the worker.
If you are not sure, stay NORG-hosted. It is the default, it needs nothing from you, and you can switch to self-hosted at any point in the trial once you have seen the mirror. Self-hosting is worth it when you specifically want AI assistants to cite your own domain.
Not from NORG — the plan and the trial are identical. Cloudflare may bill you if you move to Workers Paid, which is only necessary for busy sites that would exceed the free plan's daily request cap.
Yes. Switching works the same way on a paid plan as it does during the trial — ask Claude to switch hosting at any time. If you get stuck, email solutions@norg.ai and we will sort it out with you.
It is built not to. Every failure path — NORG down, a wrong key, a bug — ends at your origin, so visitors see your normal site. And search engines are always served exactly what humans get; that rule has no off switch.
Almost always the route. The button deploys the worker but does not attach it to traffic — add your-host/* under Domains & Routes, using the exact host your visitors use (with or without www). Also check the record is proxied (orange cloud); a DNS-only record never reaches the worker. And make sure the check sends the x-norg-edge-check header with your site key — a spoofed AI-agent User-Agent is passed through on purpose.
A token gives NORG permission to upload a new worker version into your account; the button gives NORG nothing. With a button install NORG can see from the worker's check-in that it is behind and will tell you, but only you can redeploy it.
If you care about the token having been visible in the conversation, yes — and know that revoking it stops automatic worker updates. The clean alternative is to issue the token through the dashboard route in the first place, so it never enters a chat.
Per request: your site id, the classified visitor type (which AI bot, or “human”), and the requested path. Never the page content of your own site, and never your worker logs — those stay in your account.
Encrypted, in NORG's database, and used only to deploy, update or remove the worker on your zone. It is never shown again, not even to you, and you can revoke it in Cloudflare at any time.
A self-hosted install that will not verify, a switch that did not go through, or just unsure which option suits you? Write to solutions@norg.ai and include: