Cloudflare Worker + D1

Run your own ClassSync relay.

The relay is deliberately small. It receives signed Fireflies webhook metadata, coordinates device claims and stores encrypted account-sync payloads — not lecture transcripts or summaries.

Repository access required. These commands assume you have the ClassSync source tree and are deploying the existing apps/relay package.

1. Install and authenticate

pnpm install
cd apps/relay
pnpm exec wrangler login

2. Create the D1 database

pnpm exec wrangler d1 create classsync-relay

Paste the returned database_id into wrangler.jsonc, then apply the repository migrations:

pnpm run db:migrate:remote

3. Set the relay secrets

You choose the values for these secrets. Wrangler stores them outside the repository.

pnpm exec wrangler secret put FIREFLIES_WEBHOOK_SECRET
pnpm exec wrangler secret put DEVICE_API_TOKEN
pnpm exec wrangler secret put FIREBASE_SERVICE_ACCOUNT_JSON

FIREFLIES_WEBHOOK_SECRET: legacy/global webhook signing secret used by the relay where applicable.
DEVICE_API_TOKEN: the bootstrap setup code used to create a new private ClassSync account. Pick a long random secret and keep it private.
FIREBASE_SERVICE_ACCOUNT_JSON: service account JSON used for the Android FCM fast path.

4. Deploy

pnpm run deploy

Copy the resulting HTTPS Worker URL. In ClassSync, expand Use a different relay on the Relay step and enter that URL together with the same DEVICE_API_TOKEN.

5. Create your account and webhook

After relay enrollment, the Account screen creates a private account and shows an account-specific Fireflies webhook URL plus a 32-character signing secret. Configure those values in Fireflies Webhooks V2 and subscribe to meeting.transcribed.

One hosted relay can serve multiple people. Each person creates a different private account and receives a different webhook URL/signing secret. A recovery code is only for that person's own additional devices.

Operational notes

Apply new D1 migrations before clients start relying on the corresponding relay behavior.
Changing Worker code, secrets or migrations does not change the Worker URL. Only change the app URL if you move to another Worker name, account, domain or staging deployment.
Protect public endpoints with Cloudflare rate limiting.
Do not put any of the secrets above into Git, screenshots or issue reports.