cf-access-wall
cf-access-wall secures any Cloudflare Workers hostname—including bare *.workers.dev—behind a Zero Trust login wall using a JSON specification. It supports both GitHub SSO for developers and emailed one-time codes for non-technical users, handles identity providers and service tokens for CLI/CI automation, and runs idempotently to adopt or update existing Access configurations.
cf-access-wall protects Cloudflare Workers behind GitHub SSO or email-code login using a declarative JSON spec.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-28
cf-access-wall protects Cloudflare Workers behind GitHub SSO or email-code login using a declarative JSON spec. cf-access-wall secures any Cloudflare Workers hostname—including bare *.workers.dev—behind a Zero Trust login wall using a JSON specification. It supports both GitHub SSO for developers and emailed one-time codes for non-technical users, handles identity providers and service tokens for CLI/CI automation, and runs idempotently to adopt or update existing Access configurations.
Use it when
- Yes.
- cf-access-wall enables both GitHub SSO and email OTP authentication through its JSON specification.
Verify before relying
Read SKILL.md below before installing (5 files). Open directory: indexed for reading, not audited.
Install
terrylica/cc-skills/cf-access-wall · repository language: Shell
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is cf-access-wall and how does it protect Cloudflare Workers?
cf-access-wall is an MIT-licensed tool that secures any Cloudflare Workers hostname—including bare *.workers.dev domains—behind a Zero Trust login wall. It uses a JSON specification to declaratively define Access policies, supporting GitHub SSO for developers and emailed one-time codes for non-technical users. The tool runs idempotently, allowing you to adopt or update existing Cloudflare Access configurations without manual steps.
Can cf-access-wall put workers behind authentication on bare workers.dev?
Yes. cf-access-wall specifically supports securing bare workers.dev domains without requiring a custom domain purchase. You define your authentication requirements in JSON, and cf-access-wall provisions the Zero Trust Access policies to protect those bare domains with a login wall.
How do I set up GitHub SSO and email OTP for team access control?
cf-access-wall enables both GitHub SSO and email OTP authentication through its JSON specification. You configure identity providers and authentication methods declaratively, then cf-access-wall provisions the policies. This allows developers to use GitHub login while non-technical team members receive emailed one-time codes for access.
What does declarative access control with cf-access-wall mean?
cf-access-wall uses JSON to define your Zero Trust Access policies declaratively rather than through manual UI clicks. You specify your authentication rules, identity providers, and access requirements in JSON format, then cf-access-wall provisions these policies idempotently—applying them consistently whether you're setting up new Access or updating existing configurations.
Can cf-access-wall configure service tokens for CLI and CI automation?
Yes. cf-access-wall supports provisioning service tokens for CLI and CI client authentication. This allows automated systems and deployment pipelines to authenticate against your protected Workers using service tokens managed through the same JSON specification.
What authentication methods does cf-access-wall support for non-technical users?
cf-access-wall supports email OTP (one-time code) authentication for non-technical users. Users receive emailed codes to verify their identity, providing a simple login experience without requiring GitHub accounts or other developer-focused identity providers.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
cf-access-wall — declarative Access provisioning
Zero Trust free tier covers 50 seats; Access attaches directly to *.workers.dev hostnames
(verified live 2026-07-23 — no zone, no domain purchase). One Access app offers BOTH login paths
on a single screen: GitHub for developers, emailed 6-digit code for non-technical staff
(no account creation). Enforcement is real: unauthenticated requests 302 to the team login page.
>
(truncated - see the full file via the links below)
File tree — 5 files
plugins/web-forge/skills/cf-access-wall/SKILL.md
plugins/web-forge/skills/cf-access-wall/schema/access-spec.schema.json
plugins/web-forge/skills/cf-access-wall/scripts/gh-oauth-app.mjs
plugins/web-forge/skills/cf-access-wall/scripts/setup-access.mjs
plugins/web-forge/skills/cf-access-wall/specs/example.json
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Protect Cloudflare Workers with declarative login authentication”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
dashboard-forge handles vendor dashboard operations that have no public API by driving a real Chrome browser with persistent per-site profiles, letting humans handle logins once while scripts execute the rest reproducibly. It extracts secrets safely to vault, survives UI drift through step-and-shoot methodology, and covers tasks like minting scoped tokens and creating OAuth apps where the vendor offers no API or your existing token lacks scope.
Publish static HTML content like Bokeh charts and reports to Cloudflare Workers using 1Password for secure credential storage. The skill handles setup, deployment, and token rotation for workers.dev sites, with templates for first-time configuration, adding files to existing deployments, and troubleshooting.
This skill provides production-ready patterns for adding Cloudflare Access authentication to Workers applications. It includes Hono middleware for one-line setup, manual JWT validation templates, service token support for backend auth, and solutions for common issues like CORS preflight blocking and missing headers.
Replace VPN access to internal services using Cloudflare's Zero Trust platform, which combines identity verification, device compliance checks, and encrypted tunnels to protect dashboards, admin panels, and on-premises apps. Enforce DNS-level threat filtering and support remote teams without opening inbound ports.
This skill guides you through creating a new Cloudflare Tunnel from scratch, handling token generation, .env configuration, and container restart. It covers prerequisite checks, dashboard setup, hostname routing, and connectivity verification to get your tunnel operational.
This skill automates deployment of Vibes apps to Cloudflare Workers using the Deploy API, eliminating the need for wrangler CLI or manual infrastructure setup. It manages browser-based authentication on first run, caches credentials for future deploys, and bundles static assets automatically. Optionally configure OpenRouter API keys to enable AI features in your deployed app.
More skills cloudflare-temporary-deploy (MIT) · Cloudflare Service Token Setup (unlicensed) · cloudflare-one (Apache-2.0)