> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/cipp/integrations/cloudflare.md).

# Cloudflare

CIPP stores a single set of Cloudflare Access service account credentials here, which other integrations then use to reach services sitting behind a Cloudflare Zero Trust tunnel. Entering the credentials on this page does nothing on its own. Each integration that needs them has its own toggle to turn them on.

## Settings

| Setting                                                   | Description                                                                                                                                                        |
| --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Enable Integration                                        | Makes the stored credentials available to other integrations. The credential fields stay disabled until this is on, and the webhook toggle does not appear at all. |
| CloudFlare Tunnel Service Account Client ID               | The Client ID of the Cloudflare Access service token, sent as the `CF-Access-Client-Id` header.                                                                    |
| CloudFlare Tunnel Service Account Client Secret           | The Client Secret of the service token, sent as the `CF-Access-Client-Secret` header. Stored securely and masked once saved.                                       |
| Use CloudFlare Service Account credentials with webhooks. | Adds the two headers to outbound webhook alerts, for webhook endpoints that are themselves behind Cloudflare Access.                                               |

{% hint style="info" %}
This page has no **Test** button, because there is nothing to connect to on its own. Validate the credentials by testing whichever integration you have pointed through the tunnel.
{% endhint %}

## Configuring the Integration

{% stepper %}
{% step %}

### Create a service token in Cloudflare

In Cloudflare Zero Trust, create a service token and record its Client ID and Client Secret. Make sure the Access application protecting your service accepts that token, otherwise CIPP's requests will still be challenged.
{% endstep %}

{% step %}

### Enable the integration

Turn on **Enable Integration**. The credential fields stay disabled until it is on.
{% endstep %}

{% step %}

### Enter the credentials

Enter the **CloudFlare Tunnel Service Account Client ID** and **CloudFlare Tunnel Service Account Client Secret**, then select **Submit**.
{% endstep %}

{% step %}

### Turn it on where it is needed

Enable the corresponding option in each integration that sits behind the tunnel, as listed below. Nothing uses these credentials until you do.
{% endstep %}
{% endstepper %}

## Where the Credentials Are Used

| Integration                                                                | Option to enable                                                                | Description                                                                                  |
| -------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| [Hudu](/user-documentation/cipp/integrations/hudu.md)                      | Connect to HUDU through CloudFlare Tunnel with the Service Account credentials. | Sends the Access headers with every request CIPP makes to Hudu.                              |
| [Password Pusher](/user-documentation/cipp/integrations/passwordpusher.md) | Behind a CF-ZTNA Tunnel                                                         | Sends the Access headers with every request CIPP makes to Password Pusher.                   |
| Webhook alerts                                                             | Use CloudFlare Service Account credentials with webhooks.                       | Sends the Access headers with alerts delivered to the webhook endpoint set in Notifications. |

{% hint style="info" %}
The per-integration toggles only appear once this integration is enabled and saved, so configure this page first. Both the toggle on the other integration and **Enable Integration** here must be on before the headers are sent.
{% endhint %}

{% hint style="warning" %}
The same credentials are used everywhere. If your Hudu instance and your webhook endpoint sit behind different Cloudflare Access applications, the one service token needs to be accepted by both.
{% endhint %}

***

## Feature Requests / Ideas

We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.cipp.app/user-documentation/cipp/integrations/cloudflare.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.