Cloudflare AccessRecommended
People sign in through your identity provider in the browser. The hub checks the signed Cloudflare token on every request.
HUB_AUTH_CLOUDFLARE=1
Security / Secure your hub
Your team signs in with the login it already has.
Hosted hubs sign in with Google, GitHub or Microsoft (one click from Claude Code is coming soon; today, use a key from the portal), or sit behind your team's own Cloudflare Access on your own hostname, which accepts any identity provider Access supports: Okta, Entra, Google Workspace, OIDC or SAML. Machines and scripts use API keys or service tokens. Self-hosted hubs use Cloudflare Access or API keys; follow the steps below.
Pick how people and machines sign in
You can turn on more than one. The hub tells each machine which methods it accepts, and the hub's own list of people is always the final allowlist: getting through Cloudflare isn't enough unless an admin has added you.
Access service tokenToken
A client ID and secret that lets a machine through Cloudflare without a browser. Pair it with an API key to identify the person.
HUB_EDGE=cloudflare-access
mem-sync API keysToken
A per-person key an admin creates in People. The agent sends it on every request. Turn keys off once everyone uses Access.
HUB_AUTH_API_KEYS=1
Set up Cloudflare Access
About 15 minutes in the Cloudflare Zero Trust dashboard, then one restart of the hub. You need a domain on Cloudflare and a Zero Trust account.
- 1
Publish the hub through a Cloudflare Tunnel
Run cloudflared next to the hub and give it a hostname such as hub.yourco.com. Don’t publish the hostname before step 3 puts Access in front of it.
In the dashboard: Networks › Tunnels › Create a tunnel
- 2
Connect your identity provider
Add Google Workspace, Microsoft Entra ID, Okta, GitHub, any generic OIDC or SAML provider, or email one-time codes. You can add several.
In the dashboard: Settings › Authentication › Login methods
- 3
Protect the hostname with an Access application
Add a self-hosted application for hub.yourco.com. Allow your email domain or an identity-provider group, and set the session length you want (a week works well).
In the dashboard: Access › Applications › Add an application
- 4
Let machines find the sign-in method
Add a second application for exactly hub.yourco.com/.well-known/mem-sync with one Bypass policy for Everyone. This one public file tells machines how to sign in; it holds no team data.
In the dashboard: Access › Applications › Add an application
- 5
Tell the hub
Copy the Application Audience (AUD) tag from the first application and your team domain, then set these on the hub and restart it.
HUB_AUTH_CLOUDFLARE=1 CF_ACCESS_TEAM_DOMAIN=yourco.cloudflareaccess.com CF_ACCESS_AUD=<Application Audience tag> HUB_PUBLIC_URL=https://hub.yourco.com
- 6
Check it
The discovery file should list cloudflare-access under auth_methods.
curl https://hub.yourco.com/.well-known/mem-sync
- 7
Add your people
In the hub’s People page, add each person’s email and the projects they work on. On their machine they enter the hub address and click Sign in with Cloudflare.
Token-based sign-in
Access service token for machines
- In Cloudflare, create a service token and add a Service Auth policy for it on the hub’s application.
- On the hub, set HUB_EDGE=cloudflare-access if Cloudflare sign-in isn’t on yet, so machines know to ask for it.
- On the machine, enter the hub address, the API key, and the token’s client ID and secret.
mem-sync API keys for people
- Keys are on unless HUB_AUTH_API_KEYS=0.
- An admin opens People, picks the person and creates a key. It is shown once.
- The person pastes it on the This machine page. Revoke it there when they leave.
Treat tokens like passwords. The agent stores them only on the machine, in the person's own mem-sync folder, and never prints them. Revoke a key in People or rotate a service token in Cloudflare and the next sync from that machine is refused.
Hub settings reference
| Setting | Values | What it does |
|---|---|---|
HUB_AUTH_CLOUDFLARE | 1 | 0 | Turns Cloudflare Access sign-in on. Needs the three settings below. |
CF_ACCESS_TEAM_DOMAIN | yourco.cloudflareaccess.com | Your Zero Trust team domain, without https://. |
CF_ACCESS_AUD | AUD tag | The Application Audience tag of the hub’s Access application. |
HUB_PUBLIC_URL | https://hub.yourco.com | The address machines use to reach the hub. |
HUB_AUTH_API_KEYS | 1 (default) | 0 | Per-person API keys. Turn off once everyone signs in through Access. |
HUB_AUTH_ORDER | cloudflare-access,api-key | Which methods are offered to machines, and in what order. |
HUB_EDGE | cloudflare-access | unset | The hub is behind Access but accepts keys only; machines also ask for a service token. |