@@ -116,6 +116,24 @@ Make sure to add a `test:build` and `test:assert` command to the new app's `pack
 Sentry packages are automatically resolved to the local build via pnpm overrides injected at test time, so no manual
 registry configuration is needed.
 
+### Test apps that deploy a real Cloudflare Worker
+
+Apps like `cloudflare-workers-send-to-sentry` deploy the built app as a real Worker and check what arrives in Sentry:
+
+- Use `createWorkerGlobalSetup` and `workerGlobalTeardown` from `@sentry-internal/test-utils/cloudflare` as the
+  Playwright global setup and teardown. Tests read the Worker URL from `E2E_TEST_WORKER_URL`, send requests with
+  `fetchFromWorker`, and poll Sentry with the helpers from `@sentry-internal/test-utils/cli` (the app needs `sentry` as
+  a dev dependency).
+- The Worker gets `E2E_TEST_DSN`, `E2E_TEST_WORKER_TOKEN` and the values of the `secrets` option as secrets.
+- CI keeps the Worker after the run, and anyone can reach its `workers.dev` URL. If the Worker can spend money (for
+  example, it holds an LLM API key), it must reject requests without `Authorization: Bearer <E2E_TEST_WORKER_TOKEN>`.
+  The token is new for every deploy, and `fetchFromWorker` sends it. See
+  `cloudflare-flue-send-to-sentry/src/auth.ts`.
+- Add the `workerPrefix` to `.github/workflows/cleanup-e2e-workers.yml`, which deletes the Worker of a PR when the PR
+  closes.
+- Set `"sentryTest": { "optional": true }` in `package.json`, because only the optional CI job has the Cloudflare
+  secrets.
+
 ## Troubleshooting
 
 ### Common Issues
 
@@ -1,17 +1,6 @@
-import { randomBytes } from 'node:crypto';
-import type { FullConfig } from '@playwright/test';
 import { createWorkerGlobalSetup } from '@sentry-internal/test-utils/cloudflare';
 
-const deployWorker = createWorkerGlobalSetup({
+export default createWorkerGlobalSetup({
   workerPrefix: 'e2e-flue-send-to-sentry',
-  secrets: { OPENROUTER_API_KEY: 'E2E_OPENROUTER_API_KEY', E2E_TEST_WORKER_TOKEN: 'E2E_TEST_WORKER_TOKEN' },
+  secrets: { OPENROUTER_API_KEY: 'E2E_OPENROUTER_API_KEY' },
 });
-
-/**
- * CI keeps the Worker after the run, and it holds an OpenRouter key. So its agent routes only accept
- * this token, which is new for every deploy and only known to the test run that deployed the Worker.
- */
-export default async function globalSetup(config: FullConfig): Promise<void> {
-  process.env.E2E_TEST_WORKER_TOKEN = randomBytes(32).toString('hex');
-  await deployWorker(config);
-}
@@ -2,7 +2,8 @@ import { createMiddleware } from 'hono/factory';
 
 /**
  * CI keeps the Worker after the run, and it holds an OpenRouter key. So the agent routes only answer
- * the test run that deployed the Worker, which sends the token that global-setup.ts made for it.
+ * the test run that deployed the Worker. `createWorkerGlobalSetup` makes the token for each deploy, and
+ * `fetchFromWorker` sends it.
  */
 export const requireTestToken = createMiddleware<{ Bindings: Env }>(async (c, next) => {
   const token = c.env.E2E_TEST_WORKER_TOKEN;
 
@@ -15,17 +15,16 @@ export function newInstanceId(prefix: string): string {
  */
 export async function runAgentTurn(workerUrl: string, instanceId: string, message: string): Promise<string> {
   const url = `${workerUrl}/agents/hello/${instanceId}`;
-  const authorization = `Bearer ${process.env.E2E_TEST_WORKER_TOKEN}`;
 
   await fetchFromWorker(url, 202, {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json', Authorization: authorization },
+    headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ kind: 'user', body: message }),
   });
 
   const deadline = Date.now() + 90_000;
   while (Date.now() < deadline) {
-    const conversation = JSON.parse(await fetchFromWorker(url, 200, { headers: { Authorization: authorization } })) as {
+    const conversation = JSON.parse(await fetchFromWorker(url, 200)) as {
       conversationId: string;
       settlements?: unknown[];
     };
 
@@ -12,8 +12,8 @@ export interface WorkerGlobalSetupOptions {
    */
   workerPrefix: string;
   /**
-   * The secrets of the Worker besides `E2E_TEST_DSN`, as a map from the binding name to the name of the
-   * environment variable that holds the value.
+   * The secrets of the Worker besides `E2E_TEST_DSN` and `E2E_TEST_WORKER_TOKEN`, as a map from the
+   * binding name to the name of the environment variable that holds the value.
    */
   secrets?: Record<string, string>;
 }
@@ -138,6 +138,11 @@ function getAppDir(config: FullConfig): string {
 /**
  * Returns a Playwright global setup that deploys the built test app as a real Worker. The tests read
  * its URL from `E2E_TEST_WORKER_URL`, and {@link workerGlobalTeardown} deletes it again.
+ *
+ * The Worker also gets the secret `E2E_TEST_WORKER_TOKEN`, a random value that is new for every deploy
+ * and that {@link fetchFromWorker} sends as `Authorization: Bearer <token>`. CI keeps its Workers after
+ * the run, so a Worker that can spend money (for example with an LLM API key) must reject requests
+ * without this token.
  */
 export function createWorkerGlobalSetup(options: WorkerGlobalSetupOptions): (config: FullConfig) => Promise<void> {
   return async config => {
@@ -153,8 +158,14 @@ export function createWorkerGlobalSetup(options: WorkerGlobalSetupOptions): (con
       throw new Error('CLOUDFLARE_ACCOUNT_ID must be set to deploy the test worker.');
     }
 
+    process.env.E2E_TEST_WORKER_TOKEN = randomBytes(32).toString('hex');
+
     const secrets: Record<string, string> = {};
-    for (const [binding, envName] of Object.entries({ E2E_TEST_DSN: 'E2E_TEST_DSN', ...options.secrets })) {
+    for (const [binding, envName] of Object.entries({
+      E2E_TEST_DSN: 'E2E_TEST_DSN',
+      E2E_TEST_WORKER_TOKEN: 'E2E_TEST_WORKER_TOKEN',
+      ...options.secrets,
+    })) {
       const value = process.env[envName];
       if (!value) {
         throw new Error(`${envName} must be set to deploy the test worker.`);
@@ -218,14 +229,21 @@ export function workerGlobalTeardown(config: FullConfig): void {
  * Workers Logs had no invocation for it. `status` is the status the Worker answers with. A Worker
  * that threw answers with status 500 and Cloudflare error code 1101, which sets it apart from a 500
  * that did not come from the Worker.
+ *
+ * The request carries the `E2E_TEST_WORKER_TOKEN` of {@link createWorkerGlobalSetup}, unless `init`
+ * sets its own `Authorization` header.
  */
 export async function fetchFromWorker(url: string, status: number, init?: RequestInit): Promise<string> {
   const deadline = Date.now() + 60_000;
   let lastAnswer = 'no answer';
+  const headers = new Headers(init?.headers);
+  if (process.env.E2E_TEST_WORKER_TOKEN && !headers.has('Authorization')) {
+    headers.set('Authorization', `Bearer ${process.env.E2E_TEST_WORKER_TOKEN}`);
+  }
 
   while (Date.now() < deadline) {
     try {
-      const response = await fetch(url, init);
+      const response = await fetch(url, { ...init, headers });
       const body = await response.text();
       // Cloudflare sends its error page as HTML to some clients (Node's fetch among them) and as
       // `error code: <code>` plain text to others, so the code is read from either format.