How to get alerted when Cloudflare usage-based billing jumps

The two types of Cloudflare spend monitoring

Cloudflare doesn't bundle its cost alerts into a single screen. Instead, it splits them into two distinct systems with different scopes, threshold types, and dashboard locations.

Budget alerts cover your account-wide usage-based spend across all products combined. You set a dollar threshold in USD, and Cloudflare monitors your cumulative total for the current billing period. If your total billable usage crosses that dollar figure, Cloudflare sends an email. You manage these directly inside your billing settings.

Usage notifications, on the other hand, monitor individual products using raw consumption metrics rather than dollars. You configure these under your notifications dashboard to track specific activity like Argo Smart Routing traffic volume or Load Balancing queries.

If you're trying to figure out how product charges stack up before setting thresholds, read our breakdown on how Cloudflare Workers pricing works to see how requests and CPU time convert into billed dollars.

How to create an account-wide Budget alert

You configure Budget alerts from the billing section of your Cloudflare account. They evaluate cumulative usage-based spend for the current billing period and trigger an email when your spend passes your threshold.

Follow these steps to set one up:

1. Log in to the Cloudflare dashboard and go to Manage Account > Billing.
2. Select Billable Usage.
3. Select Create budget alert.
4. Enter an Alert name (for example, "R2 spend warning").
5. Enter a Budget threshold (USD) to set the trigger amount.
6. Enter one or more addresses under Email recipients. You can add more addresses by selecting Add email.
7. Enter a Description if you want to leave an optional note about when the alert fires.
8. Save the alert.

Once configured, the alert evaluates your account spend continuously throughout the month. When your spend crosses the threshold, Cloudflare sends a single email notification to all configured recipients. It won't keep emailing you as spend climbs higher, and it automatically resets at the start of each new billing period.

To view, edit, or delete existing alerts later, navigate to Manage Account > Billing > Billable Usage and select Budget alerts.

Keep in mind that Budget alerts are informational only. They don't pause or cap usage, and your monthly invoice remains the authoritative source for billing. If you need hard cutoffs to prevent runaway charges, see our guide on whether you can put a spending limit on Cloudflare Workers, Durable Objects and R2.

Setting up per-product Usage Based Billing notifications

If you want an alert before your account-wide dollar spend spikes, you can track raw product volume with Cloudflare's platform notifications. These live outside the billing section under the central alerts interface.

To create one:

1. In the Cloudflare dashboard, go to Alerts > Platform Notifications.
2. Select Create a Notification.
3. Choose the Usage Based Billing notification type.

This notification alerts you when the usage of a chosen product exceeds a set threshold. Because these alerts monitor usage counters instead of dollars, the threshold depends on the product you pick:

• Argo Smart Routing uses a threshold of total bytes of traffic.
• Load Balancing uses a threshold of total number of DNS queries.

There are two account restrictions to note here. First, Usage Based Billing notifications are included with Cloudflare Professional plans or higher, so they aren't available on the Free plan. Second, they're only available to Pay-as-you-go accounts; most Enterprise contract accounts aren't supported.

One exception exists for image processing. Cloudflare offers an Image Transformation Notifications alert that is available on all Cloudflare plans. It notifies users who rely on free image transformations when they exceed their free quota, without requiring a paid plan upgrade.

Routing alert notifications to webhooks and Slack

While account-wide Budget alerts only deliver to email addresses, Cloudflare's platform notifications support external webhook destinations. You can send these alerts to Slack, Google Chat, PagerDuty, or any custom endpoint that accepts HTTP callbacks.

Adding a webhook destination in the dashboard

To create a webhook destination:

1. Navigate to Alerts > Destinations.
2. Locate the Webhooks card and select Create.
3. Enter a descriptive name for your destination.
4. In the URL field, enter your endpoint address.
5. Provide an optional secret if you're connecting a generic receiver.
6. Select Save and Test to verify delivery.

Once created, you can't edit the webhook URL or secret directly. When editing an existing webhook under Alerts > Destinations, you can only update the webhook's name or delete the webhook entirely.

If you want step-by-step instructions for routing alerts to external chat platforms, take a look at our walkthrough on how to send cloud billing alerts to Slack or Discord.

Service-specific webhook settings

Different notification targets handle authentication differently:

• Slack, Google Chat, Discord, and Feishu: The secret is embedded directly in the webhook URL. Cloudflare parses it automatically without requiring any manual secret configuration.
• Microsoft Teams: The secret is part of the URL provided when you create the Incoming Webhook connector. Cloudflare parses this information automatically.
• DataDog: The URL must be https://api.datadoghq.com/api/v1/events, and you must enter your DataDog API Key in the Secret field.
• OpsGenie: The URL must be https://api.opsgenie.com/v2/alerts, and the Secret must be the API Key for OpsGenie's REST API.
• Splunk: Cloudflare supports only three Splunk endpoints: services/collector, services/collector/raw, and services/collector/event. The server must have SSL enabled. If SSL is enabled on the token, use port 443; if not, use port 8088. Additionally, "Enable indexer acknowledgement" must be disabled on the Splunk HTTP Event Collector.

Generic webhook requirements and firewall rules

If you route notifications to a custom HTTP endpoint, Cloudflare enforces specific network constraints. Generic webhook alerts are only dispatched to publicly resolvable IP addresses on port 80 or port 443. If your receiver lives on a private network or listens on an alternative port, you'll need to receive and forward the payloads using Cloudflare Workers or route traffic through a Cloudflare Tunnel.

Webhook requests originate from Cloudflare's published IP ranges. If your receiving server sits behind an ingress firewall, you have to allowlist those IP addresses to receive payloads.

For generic webhooks, Cloudflare sends your configured secret inside the cf-webhook-auth request header so you can validate incoming payloads.

You can also manage webhook destinations via Terraform using the cloudflare_notification_policy_webhooks resource, which lets you pass the secret attribute explicitly:

resource "cloudflare_notification_policy_webhooks" "example" {
  account_id = var.cloudflare_account_id
  name       = "Ops Webhook"
  url        = "https://api.example.com/alerts"
  secret     = var.webhook_secret
}

Catching usage spikes early with Costbrake

Cloudflare's native budget alerts send a single email notification after spend crosses your limit, but they don't catch sudden hourly velocity spikes, and they don't offer automated safety stops.

Costbrake monitors what you spend across 23 cloud, AI, and SaaS providers, including AWS, Google Cloud, Azure, Cloudflare, GitHub, Vercel, OpenAI, Anthropic, and Supabase. On Cloudflare, Costbrake tracks raw usage across Workers, R2, Durable Objects, and other products priced at list rates, net of monthly included usage. It then replaces those estimates with billed daily dollars about a day later when Cloudflare posts them. Billed daily dollars are available on pay-as-you-go billing, while Enterprise contracts get usage-based estimates only. Note that Workers Logs charges have no live counter and show up only in the billed daily dollars.

Costbrake runs checks hourly on the Free plan, every 5 minutes on Pro and Team, and ramps up to every minute during an active spike. It flags anomalies using four detection rules:

• Spike alert: Triggers when an hour costs more than 3x your 7-day hourly baseline and at least $5 more than usual.
• Budget alerts: Fire at 50%, 80%, and 100% of your configured budget.
• Forecast alert: Fires when your month-to-date spend plus your pace over the last 72 hours projects that you'll exceed your budget by month-end.
• New-charge alert: Notifies you the first time a service appears on your bill this month with spend above $1.

Alerts deliver via email on every plan, Slack, Discord, and signed webhooks on Pro, and PagerDuty on Team.

When usage runs out of control, Costbrake provides an opt-in, reversible killswitch called brakes, available on Pro and Team plans across 18 providers. A brake never runs automatically; it only executes when an admin clicks and confirms it in the console. Every brake records the prior resource state, has an undo function, and never deletes resources.

For Cloudflare, brakes give you several granular intervention options:

• Turn off workers.dev and preview URLs: Disables public workers.dev and preview URLs for a Worker, while custom domains, routes, crons, and queues stay active.
• Pause queue delivery: Stops delivering messages to a queue's consumer Worker while producers continue sending messages safely.
• Pause cron triggers: Removes scheduled cron triggers from a Worker without altering the code.
• Detach custom domains and routes: Clears routes and custom domains so traffic stops hitting the Worker.
• Roll back to the previous version: Deploys the previous version to all traffic, mirroring wrangler rollback.
• Cap CPU time per request: Sets a low CPU limit on Workers Paid plans so expensive invocations fail with error 1102 instead of racking up compute charges.
• Turn off the r2.dev URL: Disables public bucket URLs while leaving S3 API access and Worker bindings intact.
• Block usage with a spend policy: Applies a Cloudflare spend policy that blocks Workers or Durable Objects across the entire account once spend reaches $0.01 for the billing period.

Costbrake plans are flat-priced, never taking a percentage of your spend. The Free plan costs $0 for 2 provider connections, 1 seat, and 3 budgets. Pro is $12 a month ($120 a year) for 10 connections, 3 seats, 5-minute checks, 50 budgets, and brakes. Team is $39 a month ($390 a year) for 50 connections and unlimited seats. Every workspace starts with a 14-day Pro trial with no credit card required.

To connect your account, check the Costbrake pricing page or read our agent setup instructions to let an AI coding agent configure read-only API tokens safely.