Agent skill

cloudflare-tunnel

Cloudflare Tunnel API for secure tunnels. Use when user mentions "Cloudflare tunnel", "argo tunnel", or secure connectivity.

View SKILL.md on GitHub Repository
Stars 50
Forks 8

Install this agent skill to your Project

npx add-skill https://github.com/vm0-ai/vm0-skills/tree/main/cloudflare-tunnel

SKILL.md

Cloudflare Tunnel / Access Authentication

Authenticate HTTP requests to services protected by Cloudflare Access using Service Token headers.

When to Use

  • Access internal services exposed via Cloudflare Tunnel
  • Authenticate to Cloudflare Zero Trust protected applications
  • Make API calls to services behind Cloudflare Access
  • Bypass Cloudflare Access login page for automated requests

Prerequisites

bash
export CF_ACCESS_CLIENT_ID=xxxxxxxxxxxxxxxxxxxxxxxxxxxxx.access
export CF_ACCESS_CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Create Service Token

  1. Go to Cloudflare Zero Trust Dashboard
  2. Navigate to Access → Service Auth → Service Tokens
  3. Click Create Service Token
  4. Name your token and click Generate token
  5. Copy both Client ID and Client Secret (shown only once!)

Configure Access Policy

Ensure your Access Application allows service token authentication:

  1. Go to Access → Applications → Select your app
  2. Add a policy with Service Token as Include rule
  3. Select your created token

Usage

Basic curl Request

Add two headers to authenticate through Cloudflare Access:

bash
curl -s \
  -H "CF-Access-Client-Id: $(printenv CF_ACCESS_CLIENT_ID)" \
  -H "CF-Access-Client-Secret: $(printenv CF_ACCESS_CLIENT_SECRET)" \
  "https://your-protected-service.example.com/api/endpoint"

With Additional Authentication

Many services require both Cloudflare Access AND their own authentication:

bash
curl -s \
  -H "CF-Access-Client-Id: $(printenv CF_ACCESS_CLIENT_ID)" \
  -H "CF-Access-Client-Secret: $(printenv CF_ACCESS_CLIENT_SECRET)" \
  -H "Authorization: Bearer $(printenv API_TOKEN)" \
  "https://your-protected-service.example.com/api/endpoint"

With Basic Auth

bash
curl -s \
  -H "CF-Access-Client-Id: $(printenv CF_ACCESS_CLIENT_ID)" \
  -H "CF-Access-Client-Secret: $(printenv CF_ACCESS_CLIENT_SECRET)" \
  -u "username:password" \
  "https://your-protected-service.example.com/api/endpoint"

POST Request with JSON Body

Write to /tmp/request.json:

json
{
  "key": "value"
}

Then run:

bash
curl -s -X POST \
  -H "CF-Access-Client-Id: $(printenv CF_ACCESS_CLIENT_ID)" \
  -H "CF-Access-Client-Secret: $(printenv CF_ACCESS_CLIENT_SECRET)" \
  -H "Content-Type: application/json" \
  -d @/tmp/request.json \
  "https://your-protected-service.example.com/api/endpoint"

Download File

bash
curl -s -o /tmp/output.file \
  -H "CF-Access-Client-Id: $(printenv CF_ACCESS_CLIENT_ID)" \
  -H "CF-Access-Client-Secret: $(printenv CF_ACCESS_CLIENT_SECRET)" \
  "https://your-protected-service.example.com/file"

Skip SSL Verification (Self-signed certs)

Add -k flag for services with self-signed certificates:

bash
curl -k -s \
  -H "CF-Access-Client-Id: $(printenv CF_ACCESS_CLIENT_ID)" \
  -H "CF-Access-Client-Secret: $(printenv CF_ACCESS_CLIENT_SECRET)" \
  "https://your-protected-service.example.com/api/endpoint"

Required Headers

Header Value Description
CF-Access-Client-Id <client-id>.access Service Token Client ID
CF-Access-Client-Secret <secret> Service Token Client Secret

Common Errors

Error Cause Solution
403 Forbidden Invalid or missing headers Check Client ID and Secret
403 Forbidden Token not in Access policy Add token to application's Access policy
401 Unauthorized Service's own auth failed Check service-specific credentials
Connection refused Tunnel not running Verify cloudflared is running

Tips

  1. Header order doesn't matter - CF headers can be anywhere in the request
  2. Works with any HTTP method - GET, POST, PUT, DELETE, etc.
  3. Combine with other auth - CF Access + Basic Auth, Bearer Token, etc.
  4. Token rotation - Rotate secrets periodically in Zero Trust dashboard

API Reference

Recommended Agent Skills

Expand your agent's capabilities with these related and highly-rated skills.

vm0-ai/vm0-skills

brave-search

Brave Search API for web search. Use when user says "search web", "Brave search", or asks to "find on web" without specifying Google.

50 8
Explore
vm0-ai/vm0-skills

supadata

Supadata API for YouTube/web data. Use when user mentions "Supadata", "YouTube data", "channel stats", or web scraping data.

50 8
Explore
vm0-ai/vm0-skills

roadmap-planning

Build and prioritize product roadmaps using scoring models like RICE, ICE, and value-effort matrices. Activate when creating a product roadmap, prioritizing features, sequencing initiatives, mapping dependencies, balancing team capacity, choosing between Now/Next/Later or quarterly planning, or communicating roadmap tradeoffs to executives and stakeholders.

50 8
Explore
vm0-ai/vm0-skills

qdrant

Qdrant API for vector search. Use when user mentions "Qdrant", "vector database", "semantic search", or embeddings storage.

50 8
Explore
vm0-ai/vm0-skills

calendly

Calendly scheduling API. Use when user mentions "Calendly", "calendly.com", "schedule a meeting", "booking link", "event types", or asks about interview scheduling.

50 8
Explore
vm0-ai/vm0-skills

stripe

Stripe API for payments. Use when user mentions "Stripe", "payment", "subscription", "billing", "invoice", or asks about payment processing.

50 8
Explore

Didn't find tool you were looking for?

Be as detailed as possible for better results