About cloudflare-access-app-setup
A skill for creating and updating a self-hosted Cloudflare Access application, email allowlist policy, and optional service token. It targets one-off setup, CI testing, and credential rotation without managing Pulumi state.
Key features
- 01Idempotent Access app setup
- 02Email allowlist policy creation
- 03Optional service token creation
- 04Configurable through env vars or CLI
- 05Returns app AUD and token credentials
Use cases
- 01Set up Access for a new Cloudflare Worker
- 02Add a service token for CI smoke tests
- 03Rotate service token credentials
- 04Create temporary Access apps for pull-request tests
Install
Copy the command and run it in a terminal.
npx skills add https:/After installing, type/cloudflare-access-app-setupin Claude Code to confirm it loaded.
Bundled filesassets/scripts/setup-access-app.tsREADME.md
Details
From the project READMECloudflare Access app setup (API-driven)
Creates a self-hosted Cloudflare Access application, an email-allowlist policy, and a service token for headless CLI / CI access. Idempotent: re-running updates the existing app rather than creating duplicates.
Pulumi is the recommended long-term option (declarative + drift detection), but a script is the right answer for:
- One-shot setup when you don't want Pulumi state for a single app.
- CI that needs to spin up an ephemeral Access app per PR for testing.
- Replacing the service token (rotating credentials) without re-importing the rest of the stack.
When to invoke
Use when you're:
- Setting up Access for a brand-new Cloudflare Worker without an existing Pulumi stack.
- Adding a service token to an existing Access app for CI smoke runs.
- Rotating service token credentials without touching the rest of infra.
What's in here
assets/scripts/setup-access-app.ts
Generic script. Reads config via env vars / CLI args, calls the Cloudflare API at https://api.cloudflare.com/client/v4/accounts/<id>/access/apps. Outputs the app's AUD (declare as worker.env.APP_ACCESS_AUD: bindings.text(aud) in cloudflare.config.ts) and, if --create-service-token, the token client_id + client_secret (paste into .env.cloudflare).
Inputs (env or CLI):
| Var | Required | Default |
|---|---|---|
CLOUDFLARE_API_TOKEN | yes | — |
CLOUDFLARE_ACCOUNT_ID | yes | — |
--name | yes | — |
--domain | yes | — |
--allow-emails | one of allow-emails / service-token | — |
--create-service-token | optional | false |
--session-duration | optional | 24h |
--api-base | optional | https://api.cloudflare.com/client/v4 |
When NOT to invoke
- You already use Pulumi for infra. Use the Pulumi
ZeroTrustAccessApplicationresource — drift detection is worth the extra state file. - You need a complex policy graph (multi-tenant, group membership, time-based access). The script is intentionally narrow: one email-allowlist + one optional service token.
Source
The mnemo version (with hard-coded mnemo domain defaults) is at mizchi/mnemo/blob/main/mnemo-server/scripts/setup-access-app.mjs. The version shipped here is the same script with the domain defaults parameterized.
For manual Access operations, discover the cf command with pnpm exec cf cli search "create a self hosted Access application", then inspect its schema. The bundled helper calls the REST API directly and does not require Wrangler. See cf authentication.