Cloudflare Tunnel Access 认证指南：使用服务令牌进行API调用与自动化请求

cloudflare-tunnel by vm0-ai/vm0-skills

98 周安装量

52 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/vm0-ai/vm0-skills --skill cloudflare-tunnel

云服务 API 安全

🇨🇳中文介绍

Cloudflare Tunnel / Access 认证

使用服务令牌头信息对受 Cloudflare Access 保护的服务的 HTTP 请求进行认证。

使用场景

访问通过 Cloudflare Tunnel 暴露的内部服务
向受 Cloudflare Zero Trust 保护的应用程序进行认证
向 Cloudflare Access 后端的服务发起 API 调用
为自动化请求绕过 Cloudflare Access 登录页面

前提条件

export CF_ACCESS_CLIENT_ID=xxxxxxxxxxxxxxxxxxxxxxxxxxxxx.access
export CF_ACCESS_CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

创建服务令牌

前往 Cloudflare Zero Trust 仪表板
导航至 Access → Service Auth → Service Tokens
点击 Create Service Token
为令牌命名并点击 Generate token
复制 Client ID 和 Client Secret（仅显示一次！）

配置访问策略

确保您的 Access 应用程序允许服务令牌认证：

前往 Access → Applications → 选择您的应用程序
添加一个策略，将 Service Token 作为包含规则

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

携带 JSON 请求体的 POST 请求

写入 /tmp/request.json：

{
  "key": "value"
}

curl -s -X POST \
  -H "CF-Access-Client-Id: $(printenv CF_ACCESS_CLIENT_ID)" \
  -H "CF-Access-Client-Secret: $(printenv CF_ACCESS_CLIENT_SECRET)" \
  -H "Content-Type: application/json" \
  -d @/tmp/request.json \
  "https://your-protected-service.example.com/api/endpoint"

curl -s -o /tmp/output.file \
  -H "CF-Access-Client-Id: $(printenv CF_ACCESS_CLIENT_ID)" \
  -H "CF-Access-Client-Secret: $(printenv CF_ACCESS_CLIENT_SECRET)" \
  "https://your-protected-service.example.com/file"

跳过 SSL 验证（自签名证书）

对于使用自签名证书的服务，添加 -k 标志：

curl -k -s \
  -H "CF-Access-Client-Id: $(printenv CF_ACCESS_CLIENT_ID)" \
  -H "CF-Access-Client-Secret: $(printenv CF_ACCESS_CLIENT_SECRET)" \
  "https://your-protected-service.example.com/api/endpoint"

请求头	值	描述
`CF-Access-Client-Id`	`<client-id>.access`	服务令牌客户端 ID
`CF-Access-Client-Secret`	`<secret>`	服务令牌客户端密钥

错误	原因	解决方案
403 Forbidden	请求头无效或缺失	检查客户端 ID 和密钥
403 Forbidden	令牌不在访问策略中	将令牌添加到应用程序的访问策略中
401 Unauthorized	服务自身的认证失败	检查特定于服务的凭据
Connection refused	Tunnel 未运行	验证 cloudflared 是否正在运行

请求头顺序无关紧要 - CF 请求头可以放在请求的任何位置
适用于任何 HTTP 方法 - GET、POST、PUT、DELETE 等
可与其他认证方式结合 - CF Access + 基础认证、Bearer Token 等
令牌轮换 - 定期在 Zero Trust 仪表板中轮换密钥

🇺🇸English

Cloudflare Tunnel / Access Authentication

Authenticate HTTP requests to services protected by Cloudflare Access using Service Token headers.

When to Use

Access internal services exposed via Cloudflare Tunnel
Authenticate to Cloudflare Zero Trust protected applications
Make API calls to services behind Cloudflare Access
Bypass Cloudflare Access login page for automated requests

Prerequisites

export CF_ACCESS_CLIENT_ID=xxxxxxxxxxxxxxxxxxxxxxxxxxxxx.access
export CF_ACCESS_CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Create Service Token

Go to Cloudflare Zero Trust Dashboard
Navigate to Access → Service Auth → Service Tokens
Click Create Service Token
Name your token and click Generate token
Copy both Client ID and Client Secret (shown only once!)

Configure Access Policy

Ensure your Access Application allows service token authentication:

Go to Access → Applications → Select your app
Add a policy with Service Token as Include rule
Select your created token

Usage

Basic curl Request

Add two headers to authenticate through Cloudflare Access:

curl -s \
  -H "CF-Access-Client-Id: $(printenv CF_ACCESS_CLIENT_ID)" \
  -H "CF-Access-Client-Secret: $(printenv CF_ACCESS_CLIENT_SECRET)" \
  "https://your-protected-service.example.com/api/endpoint"

With Additional Authentication

Many services require both Cloudflare Access AND their own authentication:

curl -s \
  -H "CF-Access-Client-Id: $(printenv CF_ACCESS_CLIENT_ID)" \
  -H "CF-Access-Client-Secret: $(printenv CF_ACCESS_CLIENT_SECRET)" \
  -H "Authorization: Bearer $(printenv API_TOKEN)" \
  "https://your-protected-service.example.com/api/endpoint"

With Basic Auth

curl -s \
  -H "CF-Access-Client-Id: $(printenv CF_ACCESS_CLIENT_ID)" \
  -H "CF-Access-Client-Secret: $(printenv CF_ACCESS_CLIENT_SECRET)" \
  -u "username:password" \
  "https://your-protected-service.example.com/api/endpoint"

POST Request with JSON Body

Write to /tmp/request.json:

{
  "key": "value"
}

Then run:

curl -s -X POST \
  -H "CF-Access-Client-Id: $(printenv CF_ACCESS_CLIENT_ID)" \
  -H "CF-Access-Client-Secret: $(printenv CF_ACCESS_CLIENT_SECRET)" \
  -H "Content-Type: application/json" \
  -d @/tmp/request.json \
  "https://your-protected-service.example.com/api/endpoint"

Download File

curl -s -o /tmp/output.file \
  -H "CF-Access-Client-Id: $(printenv CF_ACCESS_CLIENT_ID)" \
  -H "CF-Access-Client-Secret: $(printenv CF_ACCESS_CLIENT_SECRET)" \
  "https://your-protected-service.example.com/file"

Skip SSL Verification (Self-signed certs)

Add -k flag for services with self-signed certificates:

curl -k -s \
  -H "CF-Access-Client-Id: $(printenv CF_ACCESS_CLIENT_ID)" \
  -H "CF-Access-Client-Secret: $(printenv CF_ACCESS_CLIENT_SECRET)" \
  "https://your-protected-service.example.com/api/endpoint"

Required Headers

Header	Value	Description
`CF-Access-Client-Id`	`<client-id>.access`	Service Token Client ID
`CF-Access-Client-Secret`	`<secret>`	Service Token Client Secret

Common Errors

Error	Cause	Solution
403 Forbidden	Invalid or missing headers	Check Client ID and Secret
403 Forbidden	Token not in Access policy	Add token to application's Access policy
401 Unauthorized	Service's own auth failed	Check service-specific credentials
Connection refused	Tunnel not running	Verify cloudflared is running

Tips

Header order doesn't matter - CF headers can be anywhere in the request
Works with any HTTP method - GET, POST, PUT, DELETE, etc.
Combine with other auth - CF Access + Basic Auth, Bearer Token, etc.
Token rotation - Rotate secrets periodically in Zero Trust dashboard

API Reference

Cloudflare Access: https://developers.cloudflare.com/cloudflare-one/identity/service-tokens/
Zero Trust Dashboard: https://one.dash.cloudflare.com/

Weekly Installs

Repository

vm0-ai/vm0-skills

GitHub Stars

First Seen

Jan 24, 2026

Security Audits

Gen Agent Trust HubWarn SocketPass SnykPass

Installed on

gemini-cli80

opencode79

codex78

cursor74

github-copilot73

amp68

Azure 升级评估与自动化工具 - 轻松迁移 Functions 计划、托管层级和 SKU

104,900 周安装