Overview
Get started
Tutorials
Identity
One-time PIN login
SSO integration
Generic SAML 2.0
SAML | Centrify
Azure AD®
SAML | OneLogin
SAML | Jumpcloud
SAML | Active Directory®
PingFederate®
PingOne®
SAML | Citrix ADC
SAML | Signed AuthN requests
SAML | Keycloak
Generic OIDC
OneLogin OIDC
Centrify
Facebook
GitHub
Google
Google Workspace
LinkedIn
Okta
Okta (SAML)
Yandex
Device posture
Gateway
WARP
Azure AD
Carbon Black
CrowdStrike
Microsoft Endpoint Manager
SentinelOne
Tanium
Uptycs
Workspace ONE
Mutual TLS
OS Version
Device serial numbers
Application Check
File Check
Domain Joined
Disk Encryption
Firewall
User management
Access groups
Session management
Seat management
Short-lived certificates
Access JWTs
Validate JWTs
Application token
Service tokens
Login page
Connections
Cloudflare Tunnel
Get started
Set up a tunnel
Via the dashboard
Configuration
Via the command line
Configuration
Configuration file
Ingress rules
Cloudflared parameters
Run a tunnel
Run as a service
Linux
macOS
Windows
Useful commands
Tunnel availability and failover
Tunnel permissions
Useful terms
Downloads
GitHub
Private networks
Connect private networks
Private hostnames and IPs
Tunnel Virtual Networks
Public hostnames
DNS record
Load balancers
Tunnel administration
AWS
Azure
GCP
Kubernetes
Do more with Tunnel
Secure the server
Ports and IPs
Migrate legacy tunnels
Quick Tunnels
Tunnel hosting requirements
License
Copyrights
Connect devices
WARP
First-time setup
Download WARP
Install the Cloudflare certificate
Deploy WARP
Managed deployment
Partners
Hexnode
Intune
Jamf
JumpCloud
Kandji
Parameters
Manual deployment
WARP with firewall
WARP with legacy VPN
Bypass WARP
Local Domain Fallback
Split Tunnels
WARP settings
Remove WARP
Agentless options
DNS
Add locations
DNS resolver IPs and hostnames
DNS over HTTPS
DNS over TLS
Native OS
Router setup
HTTP
Applications
Add web applications
SaaS applications
Self-hosted applications
Cloudflare dashboard SSO application
Add non-HTTP applications
Arbitrary TCP
Scan SaaS applications
Available integrations
Google Workspace
Microsoft 365
Add bookmarks
App Launcher
Policies
Secure Web Gateway
Get started
DNS filtering
Network filtering
HTTP filtering
DNS policies
Common policies
Check that a policy is working
DNS Categories
Network policies
Common policies
SSH proxy and command logs
HTTP policies
Common policies
Global rules
Order of enforcement
Data Loss Prevention
Predefined DLP Profiles
Incompatible traffic
Tenant control
AV scanning
Applications and app types
Identity-based policies
Block page
WARP session duration
Lists
Dedicated egress IPs
Access
Policy management
Require Purpose Justification
CORS
External Evaluation rules
Application paths
Enforce MFA
Temporary authentication
Browser Isolation
Accessibility
Setup
Known limitations
Clientless Web Isolation
Extensions
Browser Isolation with firewall
Analytics
Shadow IT Discovery
Gateway Analytics
User logs
Zero Trust logs
Gateway Activity logs
Manage PII
Access Audit logs
Tunnel Audit logs
API and Terraform
Access API examples
Scoped API tokens
Terraform
Glossary
Roles and permissions
Technical limitations
FAQ

Access JWTs

Cloudflare Access uses JSON Web Tokens (JWTs) to confirm a user’s identity before allowing or denying access to sensitive resources. Cloudflare securely creates these tokens through the OAUTH or SAML integration between Cloudflare Access and the configured identity provider.

Two tokens are generated:

Global session token: a token generated when a user logs in to Access. This token is stored as a cookie at your team domain (for example, https://<your-team-name>.cloudflareaccess.com) and prevents a user from needing to log in to each application.
Application token: a token generated for each application that a user reaches. This token is stored as a cookie on the application (for example, https://jira.site.com) and may be used to validate requests on your origin.