2026-08-12 — Access setup order and API credentials

GitHub OAuth App must be registered in GitHub’s UI. There is no REST create. Cloudflare then refuses type: github identity providers without client_id / client_secret.

Team domain (https://<team-name>.cloudflareaccess.com) is the OAuth Homepage and callback. The docs hostname is the wrong Homepage URL.

Order: OAuth App → GitHub IdP → Allow policy → Access applications on the custom domain and *.pages.dev. Applications deny by default; attaching them first locks everyone out.

Zero Trust may already have a One-time PIN IdP. That is not GitHub org membership.

Credentials: a Pages-scoped API token (Composio Cloudflare API Key) can return 200 with an empty Access app list and 403 on identity providers, organizations, and policies. Access writes need the Global API Key (Composio Cloudflare) or an Access-scoped token.

Order of operations

Agents and API credentials

What agents cannot automate

Connect Cloudflare in Composio