mem-sync
Sign in Start free
Security / Secure your hub

Your team signs in with the login it already has.

Hosted hubs sign in with Google, GitHub or Microsoft (one click from Claude Code is coming soon; today, use a key from the portal), or sit behind your team's own Cloudflare Access on your own hostname, which accepts any identity provider Access supports: Okta, Entra, Google Workspace, OIDC or SAML. Machines and scripts use API keys or service tokens. Self-hosted hubs use Cloudflare Access or API keys; follow the steps below.

Google Workspace Microsoft Entra ID Okta GitHub Any OIDC provider SAML Email one-time code

Pick how people and machines sign in

You can turn on more than one. The hub tells each laptop which methods it accepts, and the hub's own list of people is always the final allowlist: getting through Cloudflare isn't enough unless an admin has added you.

Cloudflare AccessRecommended

People sign in through your identity provider in the browser. The hub checks the signed Cloudflare token on every request.

Best for: every person on the team

HUB_AUTH_CLOUDFLARE=1

Access service tokenToken

A client ID and secret that lets a machine through Cloudflare without a browser. Pair it with an API key to identify the person.

Best for: build machines, scripts, hubs moving to Access

HUB_EDGE=cloudflare-access

mem-sync API keysToken

A per-person key an admin creates in People. The agent sends it on every request. Turn keys off once everyone uses Access.

Best for: people who can’t use your identity provider

HUB_AUTH_API_KEYS=1

Set up Cloudflare Access

About 15 minutes in the Cloudflare Zero Trust dashboard, then one restart of the hub. You need a domain on Cloudflare and a Zero Trust account.

  1. 1

    Publish the hub through a Cloudflare Tunnel

    Run cloudflared next to the hub and give it a hostname such as hub.yourco.com. Don’t publish the hostname before step 3 puts Access in front of it.

    In the dashboard: Networks › Tunnels › Create a tunnel
  2. 2

    Connect your identity provider

    Add Google Workspace, Microsoft Entra ID, Okta, GitHub, any generic OIDC or SAML provider, or email one-time codes. You can add several.

    In the dashboard: Settings › Authentication › Login methods
  3. 3

    Protect the hostname with an Access application

    Add a self-hosted application for hub.yourco.com. Allow your email domain or an identity-provider group, and set the session length you want (a week works well).

    In the dashboard: Access › Applications › Add an application
  4. 4

    Let laptops find the sign-in method

    Add a second application for exactly hub.yourco.com/.well-known/mem-sync with one Bypass policy for Everyone. This one public file tells laptops how to sign in; it holds no team data.

    In the dashboard: Access › Applications › Add an application
  5. 5

    Tell the hub

    Copy the Application Audience (AUD) tag from the first application and your team domain, then set these on the hub and restart it.

    HUB_AUTH_CLOUDFLARE=1
CF_ACCESS_TEAM_DOMAIN=yourco.cloudflareaccess.com
CF_ACCESS_AUD=<Application Audience tag>
HUB_PUBLIC_URL=https://hub.yourco.com
  6. 6

    Check it

    The discovery file should list cloudflare-access under auth_methods.

    curl https://hub.yourco.com/.well-known/mem-sync
  7. 7

    Add your people

    In the hub’s People page, add each person’s email and the projects they work on. On their laptop they enter the hub address and click Sign in with Cloudflare.

Token-based sign-in

Access service token for machines

  1. In Cloudflare, create a service token and add a Service Auth policy for it on the hub’s application.
  2. On the hub, set HUB_EDGE=cloudflare-access if Cloudflare sign-in isn’t on yet, so laptops know to ask for it.
  3. On the machine, enter the hub address, the API key, and the token’s client ID and secret.

mem-sync API keys for people

  1. Keys are on unless HUB_AUTH_API_KEYS=0.
  2. An admin opens People, picks the person and creates a key. It is shown once.
  3. The person pastes it on the This machine page. Revoke it there when they leave.

Treat tokens like passwords. The agent stores them only on the laptop, in the person's own mem-sync folder, and never prints them. Revoke a key in People or rotate a service token in Cloudflare and the next sync from that machine is refused.

Hub settings reference

SettingValuesWhat it does
HUB_AUTH_CLOUDFLARE1 | 0Turns Cloudflare Access sign-in on. Needs the three settings below.
CF_ACCESS_TEAM_DOMAINyourco.cloudflareaccess.comYour Zero Trust team domain, without https://.
CF_ACCESS_AUDAUD tagThe Application Audience tag of the hub’s Access application.
HUB_PUBLIC_URLhttps://hub.yourco.comThe address laptops use to reach the hub.
HUB_AUTH_API_KEYS1 (default) | 0Per-person API keys. Turn off once everyone signs in through Access.
HUB_AUTH_ORDERcloudflare-access,api-keyWhich methods are offered to laptops, and in what order.
HUB_EDGEcloudflare-access | unsetThe hub is behind Access but accepts keys only; laptops also ask for a service token.