Use Cloudflare Access for sign-in

Let people sign in to a Cloudflare deployment without WorkOS by connecting Artifact Server to Cloudflare Access through OIDC.

Cloudflare Access can provide browser sign-in for an Artifact Server deployment. You add an OIDC application record in Cloudflare Access, then give the resulting client settings to the Artifact Server deployment. You do not deploy another application.

Before you begin

You need:

a Cloudflare Zero Trust organization;
an identity provider enabled in Cloudflare Access;
the final Artifact Server application domain; and
the email address configured as bootstrapAdministratorEmail.

Cloudflare can use its own account membership as the identity provider. Enable Restrict to account members if only members of that Cloudflare account may sign in. Otherwise, connect the identity provider your team already uses.

Add Artifact Server to Cloudflare Access

In Cloudflare Zero Trust, open Access controls → Applications and create a SaaS application that uses OIDC. This record represents Artifact Server. It is not a second Worker or website.

Configure the OIDC application:

Add this redirect URL, replacing the example domain:
```
https://artifacts.example.com/auth/callback
```
Enable the openid, email, and profile scopes.
Enable Proof Key for Code Exchange (PKCE).
Select the identity providers people may use.
Add an Access policy that allows the intended people.
Create the application, then copy its client ID, client secret, and configuration endpoint.

Open the configuration endpoint and copy the exact value of its issuer field. Artifact Server checks that value against the signed ID token and the discovery document.

Cloudflare maintains the current generic OIDC application instructions. Follow those instructions if the Cloudflare interface differs from the steps above.

Configure the deployment

Copy deploy/cloudflare/examples/cloudflare-access.config.json to a file outside the repository and replace every example value.

Add the non-secret OIDC settings and a non-secret reference for the client secret to the Cloudflare deployment JSON:

{
  "oidcClientId": "YOUR_CLOUDFLARE_ACCESS_CLIENT_ID",
  "oidcClientSecretRef": "cloudflare-secrets-store://artifact-server-oidc-client-secret",
  "oidcIssuer": "https://YOUR_TEAM.cloudflareaccess.com/cdn-cgi/access/sso/oidc/YOUR_CLIENT_ID",
  "oidcScopes": "openid email profile"
}

Use the exact issuer from Cloudflare’s configuration endpoint. Do not copy the client secret into the JSON file.

Resolve the referenced secret into the deployment process environment without printing it or adding it to shell history:

read -rsp 'Cloudflare Access client secret: ' ARTIFACT_SERVER_OIDC_CLIENT_SECRET
export ARTIFACT_SERVER_OIDC_CLIENT_SECRET

In CI, load the same variable from the approved secret manager. Do not commit the value or paste it into an issue.

Do not include workosClientId, workosIssuer, or workosApiKeySecretRef in the same deployment. One installation uses one browser-login provider.

Run the normal Cloudflare lifecycle commands:

pnpm plan
pnpm deploy

Open the Artifact Server application domain in a private browser window. Sign in through Cloudflare Access. The person whose email matches bootstrapAdministratorEmail becomes the first administrator.

Check these outcomes before inviting the team:

Cloudflare returns the browser to /auth/callback on the application domain.
Artifact Server opens the signed-in review application.
A person not allowed by the Access policy cannot complete sign-in.
A person allowed by Access but not admitted to Artifact Server cannot enter the installation.

The Worker test suite covers the generic OIDC path and Cloudflare-shaped issuer URLs. A live Cloudflare Access round trip is not yet attached to the release ledger. Verify the flow in a non-production stage before using it in production.

Connect remote agents

Sign in as an administrator. Open Settings → API keys and issue a key for the person or service that will use it. Grant only the capabilities that client needs and set an expiration date. Add the key through the client’s secret input or deployment secret manager.

Cloudflare Access service tokens can restrict whether a request reaches the Worker, but Artifact Server does not currently turn a service token into an Artifact Server user or service identity. A service token alone does not replace the scoped Artifact Server API key.