Check that an empty source list means an empty account
The Add a source form is not a fixed list. It is built from a live read of your Cloudflare account: the engine asks what exists, and the form offers what came back. That read is deliberately fail-open per product, and the consequence is worth a page of its own.
If your discovery token can list your KV namespaces but not your R2 buckets, the read does not fail. It returns your namespaces, returns an empty list for R2, and answers normally. The form shows no buckets. Nothing is red, because from the form’s point of view nothing went wrong.
Three states that look identical
An empty product list in that form is one of three things, and they look the same:
- The account genuinely holds none of that product. Honest absence, and the common case.
- The token cannot see them. A 401 or 403 scope gap. The resources exist and you were never shown them.
- The listing was truncated. It hit a page cap, so resources past the cap exist and were never shown.
The second and third are data loss by omission, and they are quiet in the worst way: you configure backups for the sources you were shown, the estate looks covered, and the un-shown resources are never protected. There is no failed run to investigate, because nothing failed. The gap only appears when you go looking for something in an archive and find it was never in scope.
Fail-open is still the right default. A single missing scope should not stop you setting up the seven products the token can read. But it means an empty list is a question, not an answer.
What the console does tell you
If the whole discovery read fails, the Overview’s coverage tile says so and names the fix rather than leaving you to guess:
- Your session could not read discovery: sign in again, then refresh.
- Cloudflare rate-limited the account read: it should resolve on the next refresh.
- The engine could not read your account, usually an expired, revoked or under-scoped token: re-paste it on Sources.
- The engine could not be reached at all.
Each of those says coverage is unknown, which is the honest word: not zero, not fine, unknown.
If no discovery token is stored at all, the account-wide surfaces are not read and cannot be. Account discovery is opt-in, so this is the state a new deployment starts in. The engine answers with its own bindings and nothing else, and the Overview’s coverage grid says which surfaces that leaves it unable to see:
The four binding surfaces still read normally, because the engine reaches Workers KV, R2, D1 and Secrets Store through its own bindings rather than the account API. The five account-wide surfaces read Needs a discovery token and link to Sources, which is the control that clears them. Nothing here is a fault, and none of it means those surfaces are absent from your account: they have not been looked for yet.
If only one product degrades, that is the case this page exists for. The route still answers normally, so the console has nothing to show you, and the engine records the per-product verdict into the support pack instead. The recorded verdicts distinguish ok and empty from truncated, denied, rate-limited, not-found, unavailable and a transport failure, so the distinction is recoverable after the fact. An honestly empty account is not treated as a fault; a truncated listing is.
How to check before you rely on it
Compare against what you know exists. If you know the account has R2 buckets and the form offers none, that is state 2 or 3, not state 1. This sounds obvious and it is the whole check: nobody else can make it, because only you know what should be there.
Check the token’s scope per product, not overall. A token that reads KV and not R2 is not a broken token, and it will not present as one. Scope is granted per product and the failure is per product.
Read the record counts on the first run. A source you expect to contribute thousands of records contributing none is the same signal as an empty form, arriving after the fact. It is worth looking on the first run rather than at recovery.
If you are near a page cap, verify the tail rather than the head. A truncated listing shows you the beginning of the list, so the resources you are most likely to notice missing are the ones you would check last.
Where this fits
- Selectors and scope is the other way to end up with an empty scope and a green run, by a prefix that matches nothing.
- Connect a source covers the discovery token and the scopes it needs.
Last updated .