TL;DR: Service accounts cannot complete an interactive Zero Trust login, so stop automating the login page. Create a Zero Trust service token for the application and send its Client ID and Client Secret as request headers; the agent authenticates with no browser and no login flow.

```text
browser automation failed on cloudflare zero-trust login when agent tried the service account
```

## Steps

1. In Zero Trust Access, create a service token for the protected application.
   Expected: a Client ID and Client Secret pair issued for that app.
2. Have the agent send both values as request headers (the CF-Access-Client-Id and CF-Access-Client-Secret headers) on its requests to the app.
   Expected: requests authenticate at the edge.
3. Verify with a simple authenticated request to the protected app.
   Expected: the app content returns with a 200, not a redirect to the login page.
4. Remove the Zero Trust login automation from the agent's runbook.
   Expected: the agent never faces the interactive flow again.

## Use this when

- An agent automates the Zero Trust login page with a service account and gets stuck
- Machine-to-machine access to an app behind Cloudflare Access is needed
- The login page loops or rejects the service account credentials

## Not for this skill when

- A human needs to sign in interactively (use SSO as designed)
- The app is not behind Cloudflare Access (this skill does not apply)
- The service token itself is rejected (check the token is bound to the right app)

## Variant phrasings

- cloudflare access service token for automation
- zero trust login fails for service account
- CF-Access service token headers
- agent authenticate to app behind cloudflare access

## Why it happens

Zero Trust service accounts are non-human identities by design: they have no interactive login session to complete. The login page expects a human SSO flow, so automating it as a service account can never succeed. Service tokens are the machine counterpart, validated at the edge from headers before the request ever reaches the login page.

## Edge cases

- Service tokens are per-application; a token for app A does not open app B.
- Rotate the secret on a schedule and update the agent's stored headers the same day.
- If the app also sits behind additional auth, the service token only clears the Access layer.
- Never log the secret value; treat it like any other credential.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_z8nBO7LIEacne-wMgQaf-g