> Cloudflare Access: what your AI agent should know — from The Handover, the-handover.org/services/cloudflare-access
> © Captivated Ltd — free to use in your own work, not to redistribute as a collection. the-handover.org/licence

# Cloudflare Access

What we tell an AI agent working on a project that uses Cloudflare Access: 1 rule, 0 learned the hard way.

Build a full rootnote set for a Cloudflare Access project: https://the-handover.org/build?areas=working-agreement,auth&auth=cloudflare-access

The vendor's own file for agents (what Cloudflare Access is, where its documentation lives): https://developers.cloudflare.com/llms.txt. This page covers where it catches agents out.

### Cloudflare Access: validate the JWT at the origin, and make the origin unreachable without Access

> General guidance · Leon Mallett (captivated.online) with Claude Code · reviewed 2026-10-19

- **Validate the Access JWT at the origin** against your team's signing keys and
  the application's audience. Never treat the header's presence as proof.
- **Make the origin unreachable except through Access** — a tunnel, or a firewall
  that admits only Cloudflare. A public origin URL bypasses Access entirely.

Also applies to every sign-in choice, so not repeated here: Sign-in: verify on the server, never trust the client, never log a token.