ST-2026-100 · Authentication & identity
Cloudflare Access adds managed OAuth for non-browser clients
Cloudflare Access managed OAuth lets interactive non-browser clients discover a standard authorization-code flow and receive an opaque user access token while the origin continues to receive an Access assertion.
Previous state
Non-browser clients received a 302 browser-login redirect they could not complete and typically needed the additional cloudflared access curl tooling.
Current state
When managed OAuth is enabled, Access returns 401 with WWW-Authenticate discovery metadata, runs a standard OAuth 2.0 authorization-code flow through the user’s browser, and issues an opaque token for later requests while continuing to enforce the existing Access policies.
Affected users
Who needs to care
Cloudflare Zero Trust administrators and developers exposing self-hosted Access applications, MCP server applications or MCP server portals to interactive CLIs, AI agents, SDKs and scripts that authenticate an end user.
Required response
What to do
Enable Managed OAuth in the Access application or portal settings, or set oauth_configuration.enabled=true through the API; verify client discovery and browser authorization; and ensure an MCP server validates the Cf-Access-Jwt-Assertion that Access forwards to the origin.
Evidence boundary
What the source does not prove
Managed OAuth is opt-in for existing self-hosted applications and enabled by default only for new MCP server portals. Do not enable it behind an origin that depends on its own OAuth server or WWW-Authenticate headers, and do not use this user-based flow as a substitute for service tokens in unattended machine-to-machine work.
Lifecycle history
Dated event sequence
- Managed OAuth launched
Cloudflare Access added an OAuth 2.0 authorization-code transport for user-interactive non-browser clients while retaining the same Access policy evaluation.
Evidence ledger
First-party sources
- 01Cloudflare — Managed OAuth for Cloudflare Access
Official Cloudflare changelog · 2026-03-20
Open official source ↗ - 02Cloudflare — Managed OAuth
Official Cloudflare Access documentation · 2026-07-01
Open official source ↗