Get started
Protect owner access
Set up sign-in and a temporary token before onboarding a domain.
On this page
Configure Cloudflare Access#
- Create a self-hosted Access application for the app hostname.
- Allow the owner email set in
OWNER_EMAIL. - Add members to the Access policy as needed. Mail access also requires address grants inside Box Ox.
- Create path-specific Access bypass rules for the public protocol endpoints below.
- Record the application's audience tag and your team's HTTPS domain.
| Bypass paths | Authentication handled by Box Ox |
|---|---|
/mcp, /mcp/* | MCP OAuth |
/oauth/token, /oauth/register, /.well-known/* | OAuth protocol checks |
/api/agent, /api/agent/* | Agent credentials |
/dev/v1, /dev/v1/* | Developer API keys |
/t/*, /f/* | Tracking or file URL signatures |
/health, /health/* | Public operational status, without mail content |
Configure both exact paths and descendant paths where listed. Keep /oauth/authorize, consent pages, /setup, the app, and owner APIs behind Access. Do not bypass all of /oauth/* or /api/*. Check that a more general Access application does not override the intended path policy.
Set the values interactively, using the generated installation config:
pnpm exec wrangler secret put ACCESS_AUD --config .wrangler/deploy/wrangler.json
pnpm exec wrangler secret put TEAM_DOMAIN --config .wrangler/deploy/wrangler.jsonTEAM_DOMAIN is the HTTPS origin, such as https://your-team.cloudflareaccess.com. Do not put a trailing path in it. The Worker verifies the Access JWT and its audience. It fails closed on protected routes until both settings exist. A public health response does not verify Access configuration.
Create the setup token#
Create a short-lived Cloudflare API token restricted to the installation account and the zones you plan to onboard. The starter token template provides a starting point. It preselects Zone Read, DNS Edit, Queues Edit, and Workers R2 Edit. The template is incomplete: add the Email Sending, Email Routing, and AI Gateway permissions required by your choices. Replace its broad account and zone selections before creating the token. Cloudflare can change permission labels. Use the setup screen's checks to find missing scopes.
| Permission | Use |
|---|---|
| Zone Read | List and inspect your zones |
| DNS Edit | Apply the reviewed sending and receiving DNS records |
| Email Sending Edit, Paid only | Enable sending and inspect account limits |
| Email Routing Edit | Enable receiving, catch-all rules, and subaddressing |
| Queues Edit, Paid domain setup only | Subscribe email delivery events to the event queue |
| Workers R2 Edit | Inspect lifecycle rules during setup; manage lifecycle rules through the Cloudflare API |
| AI Gateway Edit, when AI is enabled | Apply gateway privacy and spending settings and check billing access |
Store the token as a Worker secret. Paste it at the prompt:
pnpm exec wrangler secret put CF_API_TOKEN --config .wrangler/deploy/wrangler.jsonThe deployment helper already sets CF_ACCOUNT_ID. Do not commit tokens to source or paste them into command arguments. The wizard can verify token status and probe its account access before changing DNS.