Application token

Cloudflare Access includes the application token with all authenticated requests to your origin. A typical JWT looks like this:

eyJhbGciOiJSUzI1NiIsImtpZCI6IjkzMzhhYmUxYmFmMmZlNDkyZjY0.eyJhdWQiOlsiOTdlMmFhZ TEyMDEyMWY5MDJkZjhiYzk5ZmMzNDU5MTNh.zLYsHmLEginAQUXdygQo08gLTExWNXsN4jBc6PKdB

As shown above, the JWT contains three Base64-URL values separated by dots:

• Header
• Payload
• Signature

Unless your application is connected to Access through Cloudflare Tunnel, your application must validate the token to ensure the security of your origin. Validation of the header alone is not sufficient — the JWT and signature must be confirmed to avoid identity spoofing.

{
	"alg": "RS256",
	"kid": "9338abe1baf2fe492f646a736f25afbf7b025e35c627be4f60c414d4c73069b8",
	"typ": "JWT"
}

• alg identifies the encoding algorithm.
• kid identifies the key used to sign the token.
• typ designates the token format.

The payload contains the actual claim and user information to pass to the application. Payload contents vary depending on whether you authenticated to the application with an identity provider or with a service token.

{
	"aud": ["32eafc7626e974616deaf0dc3ce63d7bcbed58a2731e84d06bc3cdf1b53c4228"],
	"email": "user@example.com",
	"exp": 1659474457,
	"iat": 1659474397,
	"nbf": 1659474397,
	"iss": "https://yourteam.cloudflareaccess.com",
	"type": "app",
	"identity_nonce": "6ei69kawdKzMIAPF",
	"sub": "7335d417-61da-459d-899c-0a01c76a2f94",
	"country": "US"
}

Access allows you to add custom SAML attributes and OIDC claims to your JWT for enhanced verification, if supported by your identity provider. This is configured when you setup your SAML or OIDC provider. Identity provider groups are only included in the token when you explicitly configure groups as a custom SAML attribute or OIDC claim. Access does not add them automatically.

User identity is useful for checking application permissions. For example, your application can validate that a given user is a member of an Okta or Microsoft Entra ID group such as Finance-Team.

Due to cookie size limits and bandwidth considerations, the application token only contains a subset of the user's identity. To get the user's full identity, send the CF_Authorization cookie to https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/get-identity. Your request should be structured as follows:

curl -H 'cookie: CF_Authorization=<user-token>' https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/get-identity

Access will return a JSON structure containing the following data:

{
	"type": "app",
	"aud": ["32eafc7626e974616deaf0dc3ce63d7bcbed58a2731e84d06bc3cdf1b53c4228"],
	"exp": 1659474457,
	"iss": "https://yourteam.cloudflareaccess.com",
	"common_name": "e367826f93b8d71185e03fe518aff3b4.access",
	"iat": 1659474397,
	"sub": ""
}

Cloudflare generates the signature by signing the encoded header and payload using the SHA-256 algorithm (RS256). In RS256, a private key signs the JWTs and a separate public key verifies the signature.

For more information on JWTs, refer to jwt.io ↗.