Services
Cloudflare Access
What we tell an AI agent working on a project that uses Cloudflare Access —1 rule.
Build a rootnote set for a Cloudflare Access projectPlain text
Cloudflare Access publishes its own file for agents — developers.cloudflare.com/llms.txt. That is what the tool is and where its documentation lives. This page is the other half: where it catches agents out. Why both.
Everything here is general guidance: rules an agent knows but does not reliably follow. We have not been caught out by Cloudflare Access ourselves, and this page does not pretend otherwise.
Cloudflare Access: validate the JWT at the origin, and make the origin unreachable without Access
General guidance · Leon Mallett (captivated.online) with Claude Code · reviewed 2026-10-19
- Validate the Access JWT at the origin against your team’s signing keys and
the application’s audience. Never treat the header’s presence as proof.
- Make the origin unreachable except through Access — a tunnel, or a firewall
that admits only Cloudflare. A public origin URL bypasses Access entirely.
Also applies to every sign-in choice, so it is not repeated here:
- Sign-in: verify on the server, never trust the client, never log a token
All of it is included when you build a set.