Skip to content
Cloudflare Docs

Publish a self-hosted application to the Internet

You can securely publish internal tools and applications by adding Cloudflare Access as an authentication layer between the end user and your origin server.

Prerequisites

1. Add your application to Access

  1. In Zero Trust ↗, go to Access > Applications.

  2. Select Add an application.

  3. Select Self-hosted.

  4. Enter any name for the application.

  5. In Session Duration, choose how often the user's application token should expire.

    Cloudflare checks every HTTP request to your application for a valid application token. If the user's application token (and global token) has expired, they will be prompted to reauthenticate with the IdP. For more information, refer to Session management.

  6. Select Add public hostname.

  7. In the Domain dropdown, select the domain that will represent the application. Domains must belong to an active zone in your Cloudflare account. You can use wildcards to protect multiple parts of an application that share a root path.

    Alternatively, to use a Cloudflare for SaaS custom hostname, set Input method to Custom and enter your custom hostname.

  8. Add Access policies to control who can connect to your application. All Access applications are deny by default -- a user must match an Allow policy before they are granted access.

  9. Configure how users will authenticate:

    1. Select the Identity providers you want to enable for your application.

    2. (Recommended) If you plan to only allow access via a single IdP, turn on Instant Auth. End users will not be shown the Cloudflare Access login page. Instead, Cloudflare will redirect users directly to your SSO login event.

    3. (Optional) Under WARP authentication identity, allow users to authenticate to the application using their WARP session identity.

  10. Select Next.

  11. (Optional) Configure App Launcher settings for the application.

  12. Under Block page, choose what end users will see when they are denied access to the application:

    • Cloudflare default: Reload the login page and display a block message below the Cloudflare Access logo. The default message is That account does not have access, or you can enter a custom message.
    • Redirect URL: Redirect to the specified website.
    • Custom page template: Display a custom block page hosted in Zero Trust.

  13. Select Next.

  14. (Optional) Configure advanced settings for your application:

  15. Select Save.

2. Connect your origin to Cloudflare

Set up a Cloudflare Tunnel to publish your internal application. Only users who match your Access policies will be granted access.

If your application is already publicly routable, a Tunnel is not strictly required. However, you will then need to protect your origin IP using other methods.

3. Validate the Access token

To secure your origin, you must validate the application token issued by Cloudflare Access. Token validation ensures that any requests which bypass Cloudflare Access (for example, due to a network misconfiguration) are rejected.

One option is to configure the Cloudflare Tunnel daemon, cloudflared, to validate the token on your behalf. This is done by enabling Protect with Access in your Cloudflare Tunnel settings. Alternatively, if you do not wish to perform automatic validation with Cloudflare Tunnel, you can instead manually configure your origin to check all requests for a valid token.

Users can now connect to your self-hosted application after authenticating with Cloudflare Access.

Product compatibility

When using Access self-hosted applications, the majority of Cloudflare products will be compatible with your application.

However, the following products are not supported:

You can disable Automatic Signed Exchanges and Zaraz for a specific application - instead of across your entire zone - using a Configuration Rule scoped to the application domain.