cf-access-wall
cf-access-wall secures any Cloudflare Workers hostname—including bare *.workers.dev—behind a Zero Trust login wall using a JSON specification. It supports both GitHub SSO for developers and emailed one-time codes for non-technical users, handles identity providers and service tokens for CLI/CI automation, and runs idempotently to adopt or update existing Access configurations.
cf-access-wall protects Cloudflare Workers behind GitHub SSO or email-code login using a declarative JSON spec.
AI-generated summary based on this skill's SKILL.md
Install
terrylica/cc-skills/cf-access-wall · repository language: Shell
git clone https://github.com/terrylica/cc-skills
cp -r cc-skills/plugins/web-forge/skills/cf-access-wall ~/.claude/skills/cf-access-wallnpx skillfed install terrylica/cc-skills/cf-access-wallFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is cf-access-wall and how does it protect Cloudflare Workers?
cf-access-wall is an MIT-licensed tool that secures any Cloudflare Workers hostname—including bare *.workers.dev domains—behind a Zero Trust login wall. It uses a JSON specification to declaratively define Access policies, supporting GitHub SSO for developers and emailed one-time codes for non-technical users. The tool runs idempotently, allowing you to adopt or update existing Cloudflare Access configurations without manual steps.
Can cf-access-wall put workers behind authentication on bare workers.dev?
Yes. cf-access-wall specifically supports securing bare workers.dev domains without requiring a custom domain purchase. You define your authentication requirements in JSON, and cf-access-wall provisions the Zero Trust Access policies to protect those bare domains with a login wall.
How do I set up GitHub SSO and email OTP for team access control?
cf-access-wall enables both GitHub SSO and email OTP authentication through its JSON specification. You configure identity providers and authentication methods declaratively, then cf-access-wall provisions the policies. This allows developers to use GitHub login while non-technical team members receive emailed one-time codes for access.
What does declarative access control with cf-access-wall mean?
cf-access-wall uses JSON to define your Zero Trust Access policies declaratively rather than through manual UI clicks. You specify your authentication rules, identity providers, and access requirements in JSON format, then cf-access-wall provisions these policies idempotently—applying them consistently whether you're setting up new Access or updating existing configurations.
Can cf-access-wall configure service tokens for CLI and CI automation?
Yes. cf-access-wall supports provisioning service tokens for CLI and CI client authentication. This allows automated systems and deployment pipelines to authenticate against your protected Workers using service tokens managed through the same JSON specification.
What authentication methods does cf-access-wall support for non-technical users?
cf-access-wall supports email OTP (one-time code) authentication for non-technical users. Users receive emailed codes to verify their identity, providing a simple login experience without requiring GitHub accounts or other developer-focused identity providers.
SKILL.md
rendered from the published skill — quoted content, verbatim
cf-access-wall — declarative Access provisioning
Zero Trust free tier covers 50 seats; Access attaches directly to *.workers.dev hostnames
(verified live 2026-07-23 — no zone, no domain purchase). One Access app offers BOTH login paths
on a single screen: GitHub for developers, emailed 6-digit code for non-technical staff
(no account creation). Enforcement is real: unauthenticated requests 302 to the team login page.
>
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 5 files
plugins/web-forge/skills/cf-access-wall/SKILL.md
plugins/web-forge/skills/cf-access-wall/schema/access-spec.schema.json
plugins/web-forge/skills/cf-access-wall/scripts/gh-oauth-app.mjs
plugins/web-forge/skills/cf-access-wall/scripts/setup-access.mjs
plugins/web-forge/skills/cf-access-wall/specs/example.json