Cloudflare Access

Identity-aware reverse proxy on an orange-cloud hostname. Use it to privatize static member sites (Antora sister hubs, internal runbooks) without rewriting them as apps. Readers sign in with GitHub, Google, or email one-time PIN — not with Cloudflare dashboard accounts.

GitHub path: Access does not keep a copy of the org roster. At login it asks GitHub (OAuth, then GET /user/orgs) and matches an Allow policy on GitHub organization. After that it trusts the session cookie. How that handshake works · How-to with mock screens.

Setup traps (generic)

GitHub OAuth Apps have no create API (operator pastes Client ID/secret). After the IdP exists, open Zero Trust as Cloudflare, with GitHub unlocked in the same browser → Finish setup / Test. The API enterprise-setup URL can 500 — ignore it. Authorize may list unrelated orgs (“already granted”) when OAuth restrictions are off — that does not widen Access. Access applications deny by default. A Pages-scoped API token often 403s on identity providers even when GET /access/apps returns 200. Finish GitHub setup · Other orgs on Authorize · Order of operations · What agents cannot automate.

Official

Cloudflare One / Zero Trust · Self-hosted applications · GitHub IdP

Dev-Centr docs

Why Access in front of static sites · How-to (IdP, policies, user accounts) · Org infra · Composio Cloudflare connection

Highlights

  • Standard pattern: private git + CI Direct Upload + Access on custom domain and *.pages.dev

  • Member “accounts” are GitHub org membership (or an email allowlist), not Cloudflare users

  • GitHub OAuth App is registered in GitHub’s UI (no API); Zero Trust team domain is the OAuth callback host

  • After creating the GitHub IdP, Finish setup in Zero Trust (Cloudflare dashboard; GitHub unlocked in the same browser) — the API enterprise-setup URL can 500

  • Authorize may list other orgs; unrestricted orgs can look “already granted” without widening Access

  • Pages-scoped API tokens are not Access credentials; applications deny by default until an Allow policy exists

  • Free Zero Trust ~50 seats; first Access login consumes a seat

  • Public docs stay on GitHub Pages / a public Pages project — do not put Access on docs.