cloudflare-vpc-services

VPC Services enable Workers to securely fetch data from private APIs through encrypted tunnels. Configure a VPC service binding in wrangler.jsonc with an IP or hostname, install cloudflared 2025.7.0+, and call env.VPC_SERVICE.fetch() with absolute URLs to route traffic through the tunnel.

DNS errors typically stem from incorrect hostname resolution or tunnel misconfiguration. Verify the internal hostname is resolvable, cloudflared tunnel is running, and your wrangler binding specifies the correct service endpoint and port.

Yes, VPC Services create private connectivity channels. Workers access internal APIs through authenticated, encrypted tunnels via cloudflared, keeping your private infrastructure isolated from the public internet while maintaining secure Worker-to-API communication.

Minimally. Use env.VPC_SERVICE.fetch() with absolute URLs targeting your internal hostname or IP. The port specified in binding configuration is ignored in fetch calls; pass the full URL including the path you need.

QUIC protocol support requires cloudflared version 2025.7.0 or later. This dependency ensures optimized tunnel performance and modern protocol support for Worker-to-private-API communication.

Connectivity issues often involve tunnel diagnostics, binding misconfiguration, or hostname resolution. Verify cloudflared is running, the service endpoint is reachable from the tunnel, wrangler bindings match your service configuration, and fetch() calls use absolute internal URLs.