build-cloudflare-access-sso
Installation
SKILL.md
build-cloudflare-access-sso
Put a company-only login wall in front of a subdomain you already serve: Cloudflare Access for authorization, Google Workspace (or Email OTP) for identity, and an origin lockdown so nobody reaches the app by its IP address.
When to use
- An internal tool, dashboard, staging site, or agent UI is publicly reachable on
app.example.comand must be restricted to one email domain. - An app has no login of its own — or its login was disabled — and you need auth in front of it without touching application code.
- "Sign in with Google" must gate a hostname, and the Google OAuth client / consent screen has to be configured to match.
- Access is already configured but someone can still reach the app by hitting the origin IP with a
Host:header. - You are auditing an existing Access setup and need to prove it is not bypassable.
Do NOT use for: