Check Cloudflare Worker logs

When to use this skill

• Debugging 401/500 from openagents.com or openagents.com/api.
• Verifying that a Worker receives the expected headers (e.g. X-OA-Internal-Key) and why it might return "unauthorized".
• Seeing console.log / console_error! output from the Rust API or the web app.
• Correlating with Convex logs (Convex calls the API worker; tail the API worker while reproducing).

Workers in this repo

apps/api/wrangler.toml

openagents.com/api/*

apps/web/wrangler.jsonc

openagents.com

wrangler tail

--config

--cwd

Wrangler tail (real-time only)

Basic usage

# API worker (Rust) — run from apps/api
cd apps/api
npx wrangler tail

# Web app worker — run from apps/web
cd apps/web
npx wrangler tail

Tail options

--format pretty

--format json

jq

--status ok

--status error

--method GET

--search "openclaw"

--header "x-oa-internal-key"

--sampling-rate 1

Examples

# API worker: only errors, pretty
cd apps/api
npx wrangler tail --status error --format pretty

# API worker: JSON and filter by URL path with jq
cd apps/api
npx wrangler tail --format json | jq 'select(.url | contains("openclaw"))'

# Web worker: tail while reproducing a page error
cd apps/web
npx wrangler tail

Two workers, two terminals

1. Terminal 1:

   cd apps/api && npx wrangler tail --format pretty

2. Terminal 2:

   cd apps/web && npx wrangler tail --format pretty

3. Optional: Convex logs in a third terminal:

   cd apps/web && npx convex logs --prod --success

console.log

Limitations

• Real-time only: No

  --history

  ; tail streams until you Ctrl+C.
• Sampling: Under heavy load, tail may sample; use

  --sampling-rate 1

  to reduce sampling.
• Max 10 clients: Up to 10 concurrent tail sessions per worker.
• Secrets: Logs must not print secrets; use lengths or "present/absent" in diagnostic logs.

Diagnostic logging (this repo)

• openclaw auth: no internal key header path=...

  — request reached the worker but the

  X-OA-Internal-Key

  header was missing (e.g. stripped or not sent by Convex).

• openclaw auth 401: path=... provided_len=... expected_len=...

  — header was present but value didn’t match the worker secret (compare lengths; if equal, values differ).

• openclaw auth ok path=... key_len=...

  — internal key matched; request was authorized.

wrangler tail

apps/api

[openclawApi <label>] fetch key_len=<n> url=...