Allegro Edge
Allegro Edge runs a property's published interactions in a Cloudflare Worker that sits in front of the property's origin. The worker asks Allegro which interactions apply to the visitor, rewrites the HTML before it leaves Cloudflare, and hands the decision to the SDK in the page. Gated content that the edge removes never reaches the visitor's browser.
These guides are for platform engineers running an Allegro instance and for organization admins setting Edge up for their properties.
Deployment Model
Edge workers run in the customer's Cloudflare account, not in an account Allegro owns.
- One worker per property. Each worker is named
allegro-edge-{organization}-{property}and is bound to the route{hostname}/*for that property's hostname. - The customer's account. An organization connects its Cloudflare account under Organization Settings → Allegro Edge, with OAuth or an API token. Allegro uses that connection to upload the worker and manage its routes.
- The route is the origin. Because the worker is bound to the property's own hostname, it fetches the page from the same hostname it is serving. There is no separate origin URL to configure.
- Allegro is still the decision maker. The worker calls Allegro's interaction evaluate endpoint for every page view, so targeting, meters, and entitlements behave the same as in the browser.
Edge vs. Client Delivery
Edge delivery is per property: when a property has Edge enabled and its worker is deployed, every HTML page on the hostname goes through the worker. The worker applies what it can and leaves the rest to the SDK, which reads the edge decision instead of evaluating a second time.
| Action | Where it runs |
|---|---|
| Template | Edge, when the action has a selector. Its JavaScript runs in the browser. |
| Truncation with the cut style | Edge. The content past the cut is removed from the HTML. |
| Truncation with the blur style | Browser. |
| Component | Browser. A component's cut still removes the content at the edge. |
| CSS | Edge, injected into the page head. |
| JavaScript | Edge, injected before the end of the body. |
| Cookie | Edge, sent as Set-Cookie on the response. |
| Any action with a delay | Browser, along with every action after it in the same interaction. |
Requests the worker does not transform pass straight through to the origin: any
method other than GET, non-HTML responses, non-200 responses, and the static
and admin paths listed in
Deploying the Worker.
There is no per-interaction choice between edge and client delivery, and no exemption for bots. Crawlers receive the same edge-rendered page as any other anonymous visitor.
Security Premise
Edge only protects content if visitors cannot reach the origin directly. If the origin answers requests that skip Cloudflare, anyone can fetch the full page from it and bypass the worker. Locking the origin down is a required onboarding step; see Prerequisites.
The worker also authenticates itself to Allegro with a per-property edge key. Allegro trusts the visitor IP and location the worker forwards only when that key matches, so geo targeting and per-visitor rate limits keep working behind the edge.
In This Section
- Prerequisites: origin lockdown and a Cloudflare connection.
- Instance Configuration: environment variables, the worker bundle, and the release step.
- Enabling Edge for a Property: connecting the account and turning Edge on.
- Deploying the Worker: automatic releases and manual deploys.
- Operating Edge: kill switches, failure behavior, caching, and debugging.