> ## Documentation Index
> Fetch the complete documentation index at: https://keyflare.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & Backup

> Monitor your Keyflare instance and define your backup strategy.

# Monitoring

## Health Check

```bash theme={null}
curl https://keyflare.your-account.workers.dev/health
# → { "ok": true, "data": { "ok": true, "version": "0.1.0" } }
```

## Worker Logs

Real-time logs and error traces are available in the **Cloudflare dashboard**:

1. Go to **Workers & Pages** → select your `keyflare` Worker
2. Open the **Logs** tab
3. Filter by status, outcome, or time range

## D1 Metrics

Available in the Cloudflare dashboard under **Storage → D1**:

* Query count
* Rows read/written
* Database size
* Error rate

# Backup & Recovery

## D1 Backup

Cloudflare automatically backs up D1. To export your database manually, run:

```bash theme={null}
npx wrangler d1 export keyflare --output backup.sql
```

If you deployed a custom-named instance, replace `keyflare` with your Worker name (e.g., `keyflare-prod`).

Store the resulting `backup.sql` file in a secure location outside of Cloudflare.

## Master Key Backup

<Warning>
  **The MASTER\_KEY is critical.** Without it, all encrypted data is permanently unrecoverable.
</Warning>

Recommended storage:

* Password manager (1Password, Bitwarden)
* Printed in a physical safe
* HSM for enterprise setups

**Never store in:**

* Git repositories
* Plain text files
* CI environment variables
* The D1 database itself

## Disaster Recovery

| Scenario                | Recovery                                                                                        |
| ----------------------- | ----------------------------------------------------------------------------------------------- |
| Worker deleted          | Run `kfl init` (or `kfl init --name <name>` for custom instances). Your D1 data remains intact. |
| D1 data corrupted       | Restore from Cloudflare's automatic backups via the dashboard.                                  |
| D1 deleted              | Restore `backup.sql` into a new D1 database, then run `kfl init --d1id <new-db-uuid>`.          |
| MASTER\_KEY lost        | **Unrecoverable.** Create a new instance with `kfl init`, then re-upload all secrets.           |
| MASTER\_KEY compromised | Revoke all API keys. Create a new instance with `kfl init`. Re-upload all secrets.              |
| API key compromised     | `kfl keys revoke <prefix>` — takes effect immediately.                                          |

# Security Checklist

* Master key backed up securely
* First User Key stored in password manager
* System keys created for CI/CD with minimal scopes
* Custom domain with TLS enabled
* Regular key rotation schedule established

<h2 noAnchor>Next Steps</h2>

<CardGroup cols={2}>
  <Card href="/architecture/security" title="Security Model">
    Understand the threat model and encryption boundaries.
  </Card>

  <Card href="/guides/api-keys" title="API Keys">
    Create and manage scoped keys for CI/CD and services.
  </Card>
</CardGroup>