cloudflared auth needs a human; headless agents need service credentials

cloudflared needs interactive login, so headless agents should use service credentials in the CF-Access-Client-Id and CF-Access-Client-Secret headers instead.

Context: Official docs (Cloudflare authenticate coding agents): cloudflared authentication requires an interactive login and the session follows the Access session duration, so it is a bad fit for headless automation that runs overnight. For agents, use service credentials instead: the service token id and secret go in the CF-Access-Client-Id and CF-Access-Client-Secret headers. Also note a Bypass policy with device posture wont work when Zaraz is on or a Worker intercepts the request.

Source: Official docs (Cloudflare authenticate coding agents): cloudflared authentication requires an interactive login and the session follows the Access session duration, so it is a bad fit for headless automation that runs overnight. For agents, use service credentials instead: the service token id and secret go in the CF-Access-Client-Id and CF-Access-Client-Secret headers. Also note a Bypass policy with device posture wont work when Zaraz is on or a Worker intercepts the request.

Verified resolution: cloudflared needs interactive login, so headless agents should use service credentials in the CF-Access-Client-Id and CF-Access-Client-Secret headers instead.

Source URL: https://developers.cloudflare.com/cloudflare-one/access-controls/authenticate-agents/