{"_self":{"principle":"Self-explaining payload — no external context required. This _self block describes what you are reading and where to look next.","widget":"article_topology","feature":"topology","name":"Article topology","what":"Claims, sources, anecdotes, user reports, related embeds, question graph slice — for ask/ROUTER.","contains":"claims, sources, anecdotes, question_graph slice","slug":"cloudflare-os-access","urls":{"read":"https://miscsubjects.com/api/articles/cloudflare-os-access/topology"},"how_to_use":"Claims, sources, anecdotes, user reports, related embeds, question graph slice — for ask/ROUTER.","write":null,"imessage":null,"router_tag":null,"proof_chain":[{"step":1,"claim":"Articles are voxel graphs of tiered claims, not prose blobs.","verify":"https://miscsubjects.com/api/articles/constitution"},{"step":2,"claim":"Claims link to hash-chained sources via source_ids.","verify":"https://miscsubjects.com/api/articles/cloudflare-os-access/sources"},{"step":3,"claim":"Ask reads topology; ingest/claim append to ledger.","verify":"https://miscsubjects.com/api/protocol"},{"step":4,"claim":"Models queue growth: populate → collaborate → repair → reflex.","verify":"https://miscsubjects.com/api/protocol/grow"},{"step":5,"claim":"Graph proves its own shape (reflex) and $/claim (yield).","verify":"https://miscsubjects.com/graph.html?layer=reflex"},{"step":6,"claim":"Full feature index + _explain on every API response.","verify":"https://miscsubjects.com/api/articles/system-map"}],"related_features":[{"id":"ask","name":"Ask protocol","what":"Answer only from topology; creates question_node with gaps and ingest_hint.","urls":{"read":"https://miscsubjects.com/api/articles/cloudflare-os-access/prompts","write":"https://miscsubjects.com/api/protocol/ask"}},{"id":"graph_topology","name":"Cross-article graph","what":"Merged claims/sources across condition+stack slugs for one question.","urls":{"read":"https://miscsubjects.com/api/articles/cloudflare-os-access/graph-topology?question=..."}},{"id":"question_graph","name":"Question graph","what":"Ask nodes (questions + gaps) and evidence_ingest nodes (pasted model output).","urls":{"read":"https://miscsubjects.com/api/articles/cloudflare-os-access/question-graph","write":"https://miscsubjects.com/api/protocol/ask"}},{"id":"voxels","name":"Voxel graph","what":"Claims as atoms, sources as edges (supported_by, posted_by). Per-claim provenance.","urls":{"read":"https://miscsubjects.com/api/articles/cloudflare-os-access/voxels","write":"https://miscsubjects.com/api/protocol/claim"}}],"system_map":"https://miscsubjects.com/api/articles/system-map","system_map_markdown":"https://miscsubjects.com/api/articles/system-map?format=markdown","not_medical_advice":true},"_explain":{"feature":"topology","name":"Article topology","what":"Claims, sources, anecdotes, user reports, related embeds, question graph slice — for ask/ROUTER.","why":"Every feature is auditable collective intelligence","how":"Claims, sources, anecdotes, user reports, related embeds, question graph slice — for ask/ROUTER.","model":null,"verifies":null,"urls":{"read":"https://miscsubjects.com/api/articles/cloudflare-os-access/topology"},"imessage":null,"router":null,"related":[{"id":"ask","what":"Answer only from topology; creates question_node with gaps and ingest_hint."},{"id":"graph_topology","what":"Merged claims/sources across condition+stack slugs for one question."},{"id":"question_graph","what":"Ask nodes (questions + gaps) and evidence_ingest nodes (pasted model output)."},{"id":"voxels","what":"Claims as atoms, sources as edges (supported_by, posted_by). Per-claim provenance."}],"not_medical_advice":true},"slug":"cloudflare-os-access","title":"Cloudflare Access authenticates the edge, not your application","register":"essay","tags":["cloudflare","architecture","security","cloudflare-os","access","zero-trust","authentication"],"updated_at":"2026-07-26T06:23:26.226Z","body_excerpt":"Cloudflare Access sits between a request and an origin. For a person, it turns an application URL into an identity check: Cloudflare redirects the browser to an identity provider, applies an Access policy, and issues a signed session token. For a machine, there is no login page. It must send a service credential on the first request, and the Access policy must explicitly accept that credential.\n\nThe distinction that decides the design:\n\n> Access proves that a request satisfied an edge policy. Your application still decides what that authenticated principal may do.\n\nA service token can pass Access and still carry no human identity. A Bypass rule can make a path reachable while removing Access authentication and Access logging from that path. Deleting the application does not prove the service token was deleted, and deleting the token does not prove the application or policy disappeared. Those are separate objects with separate list and delete operations.\n\n## Evidence status\n\n**Observed** marks first-party measurements or runtime receipts from the named environment.\n**Derived** marks arithmetic calculated from cited inputs. **Specified** marks vendor or standards\ndocumentation. **Implemented** and **deployed** name code and live-state evidence, respectively.\n**Reproduced** means the stated procedure was rerun. **Externally attested** marks operator reports;\nthose reports show that an experience occurred, not that it is universal.\n\n## The request path, without product names hiding the mechanics\n\n| Stage | Human request | Machine request |\n| --- | --- | --- |\n| 1. Request arrives | Browser requests the protected hostname and path | HTTP client requests the same URL |\n| 2. Access checks credential | Looks for a valid `CF_Authorization` cookie | Looks for service-token headers or another non-human credential |\n| 3. No valid credential | Redirects to the Access login flow | Usually a `302` the client cannot use, or `401`/`403` when Service Auth handling is configured |\n| 4. Policy evaluation | Allow, Block, Bypass, or a more specific rule | Service Auth, mTLS, or Bypass |\n| 5. Origin request | Cloudflare forwards `Cf-Access-Jwt-Assertion` | Cloudflare forwards an application JWT after service authentication |\n| 6. Origin authorization | Verify signature, issuer and audience; map `email` or `sub` to an app role | Verify the same fields; map `common_name` to a synthetic machine principal |\n\nAccess is not an origin firewall. Unless the origin is connected only through Cloudflare Tunnel or otherwise restricted to Cloudflare, an attacker may try to reach it directly and avoid the Access layer. Even when every request must pass Cloudflare, the origin still verifies the JWT. Cloudflare's application-token reference is blunt: validation of the header alone is insufficient because an unverified header can be spoofed.\n\n## Create one self-hosted application in the dashboard\n\nPrerequisites: a Cloudflare account, a Zero Trust organization, a domain on Cloudflare, and an identity provider. The built-in one-time PIN flow is enough for a small first deployment; an organization using group rules should connect its existing SAML or OIDC provider and confirm the exact group claim before writing policy.\n\nCurrent dashboard path:\n\n1. Open **Zero Trust**.\n2. Go to **Access controls** → **Applications**.\n3. Select **Add an application**.\n4. Choose **Self-hosted**.\n5. Set **Application name**.\n6. Under **Session Duration**, choose how long the application JWT remains valid.\n7. Under **Add public hostname**, enter **Subdomain**, **Domain**, and optional **Path**. A path makes the Access application narrower than the hostname.\n8. Under **Access policies**, create or attach a policy.\n9. Choose the identity providers shown on the login page.\n10. Save, then test one allowed identity and one denied identity before widening the selectors.\n\nAccess applications are deny-by-default. Creating the hostname without an Allow or Service Auth policy does not grant anyone ac","ranking":"safety-first (interaction_risk/limitations), then quote-gated effective_weight","claims":[{"id":"c1","text":"Access authenticates a request against an edge policy; the origin application still owns authorization.","tier":"system","section":"Thesis","interaction_risk":false,"status":"active","source_ids":["s1","s2","s3"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c2","text":"A browser session presents CF_Authorization while an origin should verify Cf-Access-Jwt-Assertion cryptographically.","tier":"mechanism","section":"Request path","interaction_risk":false,"status":"active","source_ids":["s1","s2","s3"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c3","text":"Self-hosted Access applications deny by default until an Allow or Service Auth policy matches.","tier":"fact","section":"Application","interaction_risk":false,"status":"active","source_ids":["s6"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c4","text":"Bypass disables Access enforcement and removes matching traffic from Access logs.","tier":"fact","section":"Policies","interaction_risk":false,"status":"active","source_ids":["s4"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c5","text":"Service Auth is the policy action for service tokens and other non-IdP authentication such as mTLS.","tier":"fact","section":"Policies","interaction_risk":false,"status":"active","source_ids":["s4","s5"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c6","text":"The Access REST API creates applications and service tokens as separate resources, and a new service-token secret is shown only once.","tier":"mechanism","section":"REST API","interaction_risk":false,"status":"active","source_ids":["s7","s8"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c7","text":"A normal service-token request needs both CF-Access-Client-Id and CF-Access-Client-Secret plus a matching Service Auth policy.","tier":"mechanism","section":"Service tokens","interaction_risk":false,"status":"active","source_ids":["s5"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c8","text":"Some native clients cannot use Access because they cannot add its custom authentication headers.","tier":"people","section":"Client compatibility","interaction_risk":false,"status":"active","source_ids":["p1","p2"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c9","text":"A service-token application JWT may carry an empty sub and no email, so the application must map a verified machine principal explicitly.","tier":"system","section":"Machine identity","interaction_risk":false,"status":"active","source_ids":["p3","r2"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c10","text":"The example origin verifier uses jose to enforce issuer, audience and RS256 against a remote JWKS.","tier":"implementation","section":"JWT verification","interaction_risk":false,"status":"active","source_ids":["s12","s3"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c11","text":"The measured team JWKS exposed two RSA/RS256 signing keys, matching the current-and-previous rotation model.","tier":"runtime","section":"JWT verification","interaction_risk":false,"status":"active","source_ids":["r3","s3"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c12","text":"An open health path does not prove authenticated application membership; an authenticated principal can still fail scoped authorization.","tier":"people","section":"Authorization seam","interaction_risk":false,"status":"active","source_ids":["p4"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c13","text":"Deleting an Access application, its policy, and a reusable service token are distinct lifecycle operations.","tier":"system","section":"Deletion proof","interaction_risk":false,"status":"active","source_ids":["r4","s7","s8"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c14","text":"Successful fresh lists must prove both the temporary application and service token absent by exact id and name.","tier":"runtime","section":"Deletion proof","interaction_risk":false,"status":"active","source_ids":["r4"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c15","text":"For one owner and closed automation, one application-checked bearer key can be smaller than Access; it gives up person-level identity and IdP offboarding.","tier":"system","section":"Alternatives","interaction_risk":false,"status":"active","source_ids":["r3"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c16","text":"Cloudflare currently advertises Free for teams under 50 and pay-as-you-go at seven dollars per user per month.","tier":"fact","section":"Pricing","interaction_risk":false,"status":"active","source_ids":["s9"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c17","text":"Remote Browser Isolation is currently an add-on, while the ten-dollar figure is a dated 2023 operator observation rather than today's vendor quote.","tier":"fact","section":"Pricing","interaction_risk":false,"status":"active","source_ids":["p6","s10"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c18","text":"A dated operator report criticized the Access console's speed and redirects; it is historical usability evidence, not a current benchmark.","tier":"people","section":"Operations","interaction_risk":false,"status":"active","source_ids":["p5"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c19","text":"Tunnel plus Access can keep an origin private while a narrow webhook path remains deliberately reachable.","tier":"system","section":"Topology","interaction_risk":false,"status":"active","source_ids":["p7","s11"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c20","text":"The temporary probe moved from 302 to 403 when Service Auth was attached, and a valid service token then cleared Access and reached the origin's 404.","tier":"runtime","section":"Live proof","interaction_risk":false,"status":"active","source_ids":["r1"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false},{"id":"c21","text":"The application's unauthenticated machine path returns bounded JSON: HTTP 401, 47 bytes, and only error and login keys.","tier":"runtime","section":"Live proof","interaction_risk":false,"status":"active","source_ids":["r3"],"why_material":"Supports the article's operator decision or verification path.","retracted_at":null,"retraction_reason":null,"challenged_by":[],"effective_weight":0.1,"quote_gated":false}],"sources":[{"id":"s1","type":"specification","url":"https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/","title":"Authorization cookie","quote":"When you protect a site with Cloudflare Access, Cloudflare checks every HTTP request bound for that site to ensure that the request has a valid `CF_Authorization` cookie.","summary":"Specifies the browser session cookie checked on protected HTTP requests.","claim_ids":["c1","c2"],"hash":"4772a7e4fab4e24aa6a452a69cac536c0d97bdbf0d3c7e563d7f3ac63520aefa"},{"id":"s2","type":"specification","url":"https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/application-token/","title":"Application token","quote":"Validation of the header alone is not sufficient — the JWT and signature must be confirmed to avoid identity spoofing.","summary":"Defines the signed application token forwarded to an origin and warns against trusting an unverified header.","claim_ids":["c1","c2"],"hash":"f9c66f5527e8d5372e10d980921fddb7d25d438d46eea8292d8c2138f0262056"},{"id":"s3","type":"specification","url":"https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/validating-json/","title":"Validate JWTs","quote":"We recommend validating the `Cf-Access-Jwt-Assertion` header instead of the `CF_Authorization` cookie, since the cookie is not guaranteed to be passed.","summary":"Documents origin JWT validation and the two-key rotation behavior of the team JWKS.","claim_ids":["c1","c10","c11","c2"],"hash":"0203131b199a02c6e39830fe36dd1cbd9057c86a3f71e338568f663c62d14349"},{"id":"s4","type":"publisher_documentation","url":"https://developers.cloudflare.com/cloudflare-one/access-controls/policies/","title":"Access policies","quote":"The Bypass action in Cloudflare Access disables Access enforcement for specific traffic.","summary":"Defines Allow, Block, Bypass and Service Auth behavior, including the loss of Access logs on bypassed traffic.","claim_ids":["c4","c5"],"hash":"49ba1d224dd549423687fdbd50f6bee94ca2431896f043e2e9245f59ef55eb04"},{"id":"s5","type":"publisher_documentation","url":"https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/","title":"Service tokens","quote":"Make sure to set the policy action to Service Auth; otherwise, Access will prompt for an identity provider login.","summary":"Explains service-token creation, the two default headers, single-header mode and Service Auth policy requirement.","claim_ids":["c5","c7"],"hash":"baa2144b975ef35a40c9228f989d2ec997eead832277982c8f08675b9bf11005"},{"id":"s6","type":"publisher_documentation","url":"https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/","title":"Add a self-hosted application","quote":"Access applications are deny by default.","summary":"Gives the dashboard creation sequence and default-deny posture for self-hosted applications.","claim_ids":["c3"],"hash":"cf61155f6c68dffe4621d724256d99f619aaaf598429f0461a8c87066d623e61"},{"id":"s7","type":"publisher_documentation","url":"https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/applications/methods/create/","title":"Create an Access application","quote":"Adds a new application to Access.","summary":"Primary REST reference for creating an Access application.","claim_ids":["c13","c6"],"hash":"abf2eea94b155e2279504d0db7e63d4bdb9d52619a47dd555b5c154da691d821"},{"id":"s8","type":"publisher_documentation","url":"https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/service_tokens/methods/create/","title":"Create a service token","quote":"This is the only time you can get the Client Secret. If you lose the Client Secret, you will have to create a new Service Token.","summary":"Primary REST reference for service-token creation and its one-time secret.","claim_ids":["c13","c6"],"hash":"f18f12824a21b0068e0a16b9b57378d60c7a568ac38ea6cf57afd825f9bf9d7b"},{"id":"s9","type":"publisher_documentation","url":"https://www.cloudflare.com/plans/zero-trust-services/","title":"Zero Trust services plans","quote":"$7 user / month","summary":"Current plan page listing Free for teams under 50 and pay-as-you-go at seven dollars per user per month.","claim_ids":["c16"],"hash":"3f91577a338eff7d436144d74712908d49f0ec34f6f96c3dcf395085a1b4d8e2"},{"id":"s10","type":"publisher_documentation","url":"https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/","title":"Remote Browser Isolation","quote":"Cloudflare Browser Isolation is available as an add-on for Cloudflare One plans.","summary":"Current documentation classifies browser isolation as an add-on without supplying the historical ten-dollar figure used by an operator in 2023.","claim_ids":["c17"],"hash":"8bd679d7a822598b84c0c199113cfb07ab68f9ef0ab81e336ec5c5e657d67c2a"},{"id":"s11","type":"publisher_documentation","url":"https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/","title":"Cloudflare Tunnel","quote":"Cloudflare Tunnel provides you with a secure way to connect your resources to Cloudflare without a publicly routable IP address.","summary":"Defines the private-origin side of the Tunnel-plus-Access pattern.","claim_ids":["c19"],"hash":"19b3957680495679c4ddc81d9b095aa0b53a224d33ccb28e9b6c7bffae692dd9"},{"id":"s12","type":"repository","url":"https://github.com/panva/jose","title":"panva/jose","quote":"`jose` is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), and JSON Web Key Set (JWKS).","summary":"Repository for the standards-based JWT/JWKS library used in the origin-verification example.","claim_ids":["c10"],"hash":"0db27a53b6c523a179cc2c6743bbd42fa32dcd79ad0acecde15f1a96dfe1e7a4"},{"id":"p1","type":"github","url":"https://github.com/jarnedemeulemeester/findroid/issues/1016","title":"Add support for Cloudflare Access Service Tokens (Custom Headers)","quote":"While browser access works (via Google SSO), the app fails because it can’t pass the required authentication headers to bypass Cloudflare Access. This limits Findroid to LAN-only use","summary":"A native Jellyfin client cannot use an Access-fronted deployment because it lacks a custom-header extension point.","claim_ids":["c8"],"hash":"4733182f1284165d252fb9053e816b99165ebe4433fefae1db2bf19fb4648a19"},{"id":"p2","type":"github","url":"https://github.com/argoproj-labs/mcp-for-argocd/issues/115","title":"Support custom HTTP headers on outbound ArgoCD API requests","quote":"Requests bypass the proxy auth and get a 302 to the SSO page (which a non-browser MCP client can't follow) or a 403.","summary":"An MCP client cannot reach ArgoCD behind Access without a way to supply service-token headers.","claim_ids":["c8"],"hash":"a0ef23ca39c941abb679fb186e7773392ffcd601f4802d953f767ec8fb63c31b"},{"id":"p3","type":"independent_measurement","url":"https://github.com/dataGriff/outcome-app-pattern-whiskey/issues/4","title":"Give Access service-token callers a usable identity","quote":"Access service-token JWTs carry an empty `sub` and no email, so a machine caller has no user id to write reviews by and no admin standing — the post-deploy smoke breaks the moment Access is enforced.","summary":"An independent implementation report showing the application-level identity gap after edge authentication succeeds.","claim_ids":["c9"],"hash":"55affd12c300f72e0bbe71483ff01c7e87a3ab2c104d6d0fc1c0436ddb81fa69"},{"id":"p4","type":"github","url":"https://github.com/lesbass/ai-newsroom/issues/4","title":"Cloudflare Access blocker prevents Paperclip API operations","quote":"All Paperclip API calls fail with `RESPONSIBLE_USER_UNAVAILABLE` error due to Cloudflare Access authentication issues.","summary":"A health path works while company-scoped requests fail because the authenticated principal is not mapped into application membership.","claim_ids":["c12"],"hash":"911dd108ce3d5371cf52e5aaa9d8a6a8bef8655300a7583147a7a952eff0d21d"},{"id":"p5","type":"people","url":"https://news.ycombinator.com/item?id=31332325","title":"Comment on Cloudflare's Access console","quote":"Well, except the Access/ZeroTrust app. Not sure why that's a different app that takes 10 seconds to redirect a bazillion times.","summary":"A dated operator report criticizing the Zero Trust console's speed and redirect behavior; used only as historical console evidence.","claim_ids":["c18"],"hash":"04ec9ea8ea4d88e81c817cde201954fb5f8b6c6fece8c316a92f76928e8e259e"},{"id":"p6","type":"people","url":"https://news.ycombinator.com/item?id=35494875","title":"Comment on Browser Isolation pricing","quote":"CloudFlare remote browsers is a $10/user/month add-on [2].","summary":"A dated operator price observation, explicitly separated from the current plan page.","claim_ids":["c17"],"hash":"b6cf6643b4b70a32625109d5ad6bd13219af98f6cd568d56bd9ea5b62675d78e"},{"id":"p7","type":"people","url":"https://news.ycombinator.com/item?id=41915668","title":"Comment on Tunnel plus Access","quote":"I've been experimenting lately with CloudFlare Tunnel + Zero Trust Access as well for exposing only the endpoints I need from an application for local development like webhooks, with the rest of the site locked behind Access.","summary":"A positive operator report of selectively public webhooks with the rest of an application behind Access.","claim_ids":["c19"],"hash":"ddd1547dd20207f94800abab7ddbe9793088cafa0539c00cdb865dc6a31f1a85"},{"id":"r1","type":"runtime_receipt","url":"https://miscsubjects.com/api/articles/cloudflare-os-access","title":"Temporary Access request-path receipt","quote":"302 before Service Auth; 403 after Service Auth; valid service token reached the origin's 404.","summary":"Redacted first-party request sequence proving edge-policy behavior without publishing the application, policy, token ids, team name or secret.","claim_ids":["c20"],"hash":"a56e74cdc3557f1f5e27886c1e2c0429a04b1bd067afa7df87dfe6208aab091b"},{"id":"r2","type":"runtime_receipt","url":"https://miscsubjects.com/api/articles/cloudflare-os-access","title":"Service application-token receipt","quote":"RS256; type app; audience and common_name present; sub empty; email absent.","summary":"Bounded fields recovered from the temporary service-token JWT.","claim_ids":["c9"],"hash":"6220755faae91395eb4bd6ae3ae278f57f7880e1fefacd7cfdee91428e3bd237"},{"id":"r3","type":"runtime_receipt","url":"https://miscsubjects.com/api/articles/cloudflare-os-access","title":"Fresh JWKS and owner-gate receipt","quote":"JWKS: HTTP 200, 4,914 bytes, two RSA/RS256 signing keys. /admin without a credential: HTTP 401, 47 bytes, keys error and login.","summary":"Fresh first-party reads of the public team JWKS and the application's bounded unauthorized machine response.","claim_ids":["c11","c15","c21"],"hash":"1e374e893edeb894b11e1241a7d7e97c4781c9eaec085cf72c928c0b9cb8537a"},{"id":"r4","type":"runtime_receipt","url":"https://miscsubjects.com/api/articles/cloudflare-os-access","title":"Temporary resource deletion proof","quote":"Both authenticated lists succeeded; exact application and service-token ids and names were absent.","summary":"Fresh post-cleanup list proof for the two independent Access collections. No failed response was treated as absence.","claim_ids":["c13","c14"],"hash":"1239356d0617555ed0837ce8d37b72db5a877d7c84b8f9f5f05a089fd787b615"}],"anecdotal_sources":[],"scientific_sources":[],"user_reports":[],"related_articles":[],"question_graph":{"slug":"cloudflare-os-access","questions":[],"evidence":[],"edges":[],"counts":{"questions":0,"evidence":0,"edges":0}},"honesty":{"active_claims":21,"retracted_claims":0,"cut_claims":0,"challenges":0,"scrub_events":0,"note":"Retracted/cut claims stay on ledger but are excluded from ask unless ?include_inactive=1"},"counts":{"claims":21,"claims_total":21,"sources":23,"anecdotal":0,"scientific":0,"user_reports":0,"questions":0,"evidence_ingests":0}}