[{"data":1,"prerenderedAt":177},["ShallowReactive",2],{"doc:cloudflare\u002Faccess":3},{"title":4,"description":5,"url":6,"markdownPath":7,"file":8,"section":9,"sectionTitle":10,"html":11,"toc":12,"navigation":36,"previous":175,"next":176},"Cloudflare access","How L4 uses your Cloudflare authorization, what the OAuth permissions are for, and how to keep, replace or revoke the access a Server keeps.","\u002Fdocs\u002Fcloudflare\u002Faccess","\u002Fdocs\u002Fcloudflare\u002Faccess.md","docs\u002Fcloudflare\u002Faccess.md","cloudflare","Cloudflare","\u003Cp>L4 never receives an account-wide Cloudflare credential that you did not approve. The installer works through your own Cloudflare OAuth authorization in your browser. After installation, the Server can keep Cloudflare access so it can update and reconfigure itself. Keeping it is on by default and you can turn it off at any time.\u003C\u002Fp>\n\u003Ch2 id=\"the-installers-oauth-grant\">\u003Ca class=\"heading-anchor\" href=\"#the-installers-oauth-grant\">The installer's OAuth grant\u003C\u002Fa>\u003C\u002Fh2>\n\u003Cp>When you select \u003Cstrong>Connect Cloudflare\u003C\u002Fstrong> at \u003Ca href=\"https:\u002F\u002Fllll.gg\u002Fcreate?tab=cloudflare\">llll.gg\u002Fcreate\u003C\u002Fa>, Cloudflare asks you to approve L4's permissions. The resulting grant:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>is encrypted inside your browser-bound installer session on llll.gg;\u003C\u002Fli>\n\u003Cli>lasts for that session only, which is one hour. Only an explicit connection renews it; polling and progress do not;\u003C\u002Fli>\n\u003Cli>is used to list the L4 Servers in the account, create Servers, and run updates or address changes you start;\u003C\u002Fli>\n\u003Cli>is removed when you select \u003Cstrong>Disconnect\u003C\u002Fstrong> or the session expires.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>If an older authorization lacks a newer permission, select \u003Cstrong>Reconnect Cloudflare\u003C\u002Fstrong> and approve again. Reconnecting keeps an unfinished installation's Server ID, Worker name and Owner claim.\u003C\u002Fp>\n\u003Ch3 id=\"requested-permissions\">\u003Ca class=\"heading-anchor\" href=\"#requested-permissions\">Requested permissions\u003C\u002Fa>\u003C\u002Fh3>\n\u003Cp>Cloudflare shows these on its consent screen. They fall into three groups.\u003C\u002Fp>\n\u003Cdiv class=\"table-wrap\">\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Group\u003C\u002Fth>\n\u003Cth>Permissions\u003C\u002Fth>\n\u003Cth>Used for\u003C\u002Fth>\n\u003C\u002Ftr>\n\u003C\u002Fthead>\n\u003Ctbody>\u003Ctr>\n\u003Ctd>Provisioning\u003C\u002Ftd>\n\u003Ctd>Account settings and memberships (read); Workers Scripts (admin, content read); D1 (read, write); Workers KV Storage (read, write); Workers R2 (read, write)\u003C\u002Ftd>\n\u003Ctd>Finding your accounts, creating and updating the Worker, database, KV namespace and buckets.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Domains and mail\u003C\u002Ftd>\n\u003Ctd>Zone (read); DNS (read, write); Email Routing rules (read, write); Email Sending (read, write)\u003C\u002Ftd>\n\u003Ctd>Server addresses and mail domains.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003Ctr>\n\u003Ctd>Optional providers\u003C\u002Ftd>\n\u003Ctd>Browser Rendering (read); Containers (read, write); Artifacts (read, write); Realtime (read, write); Queues (read, write)\u003C\u002Ftd>\n\u003Ctd>Compute nodes, Live and related features you may enable later.\u003C\u002Ftd>\n\u003C\u002Ftr>\n\u003C\u002Ftbody>\u003C\u002Ftable>\u003C\u002Fdiv>\n\u003Cp>The grant also includes offline access, so it can be refreshed while it is in use.\u003C\u002Fp>\n\u003Ch2 id=\"keep-cloudflare-access-on-this-server\">\u003Ca class=\"heading-anchor\" href=\"#keep-cloudflare-access-on-this-server\">Keep Cloudflare access on this Server\u003C\u002Fa>\u003C\u002Fh2>\n\u003Cp>The installer offers \u003Cstrong>Keep Cloudflare access on this Server\u003C\u002Fstrong> when it installs or updates a Server. It is checked by default.\u003C\u002Fp>\n\u003Cp>When it is on, after the new Server answers, the installer hands its OAuth grant to the Server once through a single-use capability and then forgets it. The Server checks that the grant reaches its own Cloudflare account and stores it encrypted with its \u003Ccode>AUTH_SECRET\u003C\u002Fcode>. If the handoff fails, the installation still succeeds, and you can connect access later in Settings.\u003C\u002Fp>\n\u003Cp>With kept access, the Server can do these on its own, without the installer:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cstrong>Updates.\u003C\u002Fstrong> \u003Cstrong>Back up and update\u003C\u002Fstrong> runs on the Server; you can close the page. See \u003Ca href=\"\u002Fdocs\u002Fcloudflare\u002Fupdates\">Updates\u003C\u002Fa>.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Server addresses.\u003C\u002Fstrong> Add, promote and remove custom domains. See \u003Ca href=\"\u002Fdocs\u002Fcloudflare\u002Fcustom-domain\">Custom domain\u003C\u002Fa>.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Mail domains.\u003C\u002Fstrong> Connect and disconnect mail domains. See \u003Ca href=\"\u002Fdocs\u002Fcloudflare\u002Fmail\">Mail\u003C\u002Fa>.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Live.\u003C\u002Fstrong> Connect Live without a separate RealtimeKit token.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>Moving files to R2 and setting up a compute node still go through the official installer.\u003C\u002Fp>\n\u003Cp>The Server renews a kept OAuth grant every week, together with its weekly backup, so it keeps working between updates. If renewal fails, Settings asks you to reconnect.\u003C\u002Fp>\n\u003Cblockquote class=\"callout callout-tip\">\u003Cp class=\"callout-title\">Tip\u003C\u002Fp>\u003Cp>For safety, run each Server in its own Cloudflare account. A free account is enough. Kept access then reaches only that Server's resources. This is a recommendation, not a requirement.\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Ch2 id=\"see-and-manage-the-kept-access\">\u003Ca class=\"heading-anchor\" href=\"#see-and-manage-the-kept-access\">See and manage the kept access\u003C\u002Fa>\u003C\u002Fh2>\n\u003Cp>Only the Owner can connect or disconnect it.\u003C\u002Fp>\n\u003Col>\n\u003Cli>Open \u003Cstrong>Server settings → Deployment → Updates\u003C\u002Fstrong>.\u003C\u002Fli>\n\u003Cli>The \u003Cstrong>Cloudflare access\u003C\u002Fstrong> card shows \u003Cstrong>Connected\u003C\u002Fstrong> or \u003Cstrong>Not connected\u003C\u002Fstrong>, the kind (\u003Cstrong>Kept from the official installer\u003C\u002Fstrong> or \u003Cstrong>API token\u003C\u002Fstrong>) and since when. It never shows the credential.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>\u003Cfigure class=\"doc-shot doc-shot-missing\">\u003Cdiv class=\"doc-shot-frame\" role=\"img\" aria-label=\"The Cloudflare access card in Server settings → Deployment → Updates, showing Connected, Kept from the official installer with a date, and a Disconnect button\">\u003Cspan class=\"doc-shot-label\">Screenshot coming soon\u003C\u002Fspan>\u003Cspan class=\"doc-shot-alt\">The Cloudflare access card in Server settings → Deployment → Updates, showing Connected, Kept from the official installer with a date, and a Disconnect button\u003C\u002Fspan>\u003C\u002Fdiv>\u003Cfigcaption>The Cloudflare access card\u003C\u002Ffigcaption>\u003C\u002Ffigure>\u003C\u002Fp>\n\u003Ch3 id=\"turn-it-off\">\u003Ca class=\"heading-anchor\" href=\"#turn-it-off\">Turn it off\u003C\u002Fa>\u003C\u002Fh3>\n\u003Cp>Select \u003Cstrong>Disconnect\u003C\u002Fstrong> on the \u003Cstrong>Cloudflare access\u003C\u002Fstrong> card. This deletes the credential from the Server. From then on, updates and address changes go through the official installer with a fresh, one-time authorization.\u003C\u002Fp>\n\u003Cp>An OAuth grant also stays revocable in your Cloudflare account. To be sure it can no longer be used, revoke L4's authorization in your Cloudflare profile as well.\u003C\u002Fp>\n\u003Cp>To stop the Server from receiving access during installation or a later update, uncheck \u003Cstrong>Keep Cloudflare access on this Server\u003C\u002Fstrong> before you start.\u003C\u002Fp>\n\u003Ch2 id=\"connect-with-an-api-token-instead\">\u003Ca class=\"heading-anchor\" href=\"#connect-with-an-api-token-instead\">Connect with an API token instead\u003C\u002Fa>\u003C\u002Fh2>\n\u003Cp>If you do not want to hand over the installer's grant, you can give the Server an API token you create yourself.\u003C\u002Fp>\n\u003Col>\n\u003Cli>Open \u003Cstrong>Server settings → Deployment → Updates\u003C\u002Fstrong>.\u003C\u002Fli>\n\u003Cli>On the \u003Cstrong>Cloudflare access\u003C\u002Fstrong> card, select \u003Cstrong>Connect with an API token\u003C\u002Fstrong>.\u003C\u002Fli>\n\u003Cli>Select \u003Cstrong>Create a token in Cloudflare\u003C\u002Fstrong>. Cloudflare opens with the token name \u003Ccode>L4 Server updates\u003C\u002Fcode> and these permissions filled in:\u003Cul>\n\u003Cli>Workers Scripts: Edit\u003C\u002Fli>\n\u003Cli>D1: Edit\u003C\u002Fli>\n\u003Cli>Workers R2 Storage: Edit\u003C\u002Fli>\n\u003Cli>Workers KV Storage: Edit\u003C\u002Fli>\n\u003Cli>Account Settings: Read\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>Select \u003Cstrong>Create\u003C\u002Fstrong> in Cloudflare and copy the token.\u003C\u002Fli>\n\u003Cli>Paste it into the \u003Cstrong>Cloudflare API token\u003C\u002Fstrong> field and select \u003Cstrong>Connect\u003C\u002Fstrong>.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>The Server checks that the token reaches the account it runs in and refuses a token for another account.\u003C\u002Fp>\n\u003Cblockquote class=\"callout callout-note\">\u003Cp class=\"callout-title\">Note\u003C\u002Fp>\u003Cp>The pre-filled token covers updates. It has no zone, DNS, Email Routing or Email Sending permissions, so adding addresses or mail domains from Settings needs a token with those permissions too, or the installer's grant.\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>To revoke a token, select \u003Cstrong>Disconnect\u003C\u002Fstrong> on the card and delete the token in your Cloudflare dashboard.\u003C\u002Fp>\n\u003Ch2 id=\"without-kept-access\">\u003Ca class=\"heading-anchor\" href=\"#without-kept-access\">Without kept access\u003C\u002Fa>\u003C\u002Fh2>\n\u003Cp>Nothing breaks. Without kept access:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>updates continue on llll.gg with a fresh Cloudflare authorization for that one update;\u003C\u002Fli>\n\u003Cli>an address change opens the official installer, which applies it with a one-time authorization. The Server receives only a single-use request, never an account-wide credential;\u003C\u002Fli>\n\u003Cli>mail domains are managed by the Server operator.\u003C\u002Fli>\n\u003C\u002Ful>\n",[13,17,21,24,27,30,33],{"id":14,"text":15,"depth":16},"the-installers-oauth-grant","The installer&39;s OAuth grant",2,{"id":18,"text":19,"depth":20},"requested-permissions","Requested permissions",3,{"id":22,"text":23,"depth":16},"keep-cloudflare-access-on-this-server","Keep Cloudflare access on this Server",{"id":25,"text":26,"depth":16},"see-and-manage-the-kept-access","See and manage the kept access",{"id":28,"text":29,"depth":20},"turn-it-off","Turn it off",{"id":31,"text":32,"depth":16},"connect-with-an-api-token-instead","Connect with an API token instead",{"id":34,"text":35,"depth":16},"without-kept-access","Without kept access",[37,62,86,102,121,143,165],{"id":38,"title":39,"pages":40},"get-started","Get started",[41,44,47,50,53,56,59],{"title":42,"url":43},"What is L4","\u002Fdocs\u002Fget-started\u002Fwhat-is-l4",{"title":45,"url":46},"Choose how to run your Server","\u002Fdocs\u002Fget-started\u002Fchoose-how-to-run",{"title":48,"url":49},"Create a Server on Cloudflare","\u002Fdocs\u002Fget-started\u002Fcreate-on-cloudflare",{"title":51,"url":52},"Install on a VPS","\u002Fdocs\u002Fget-started\u002Finstall-on-a-vps",{"title":54,"url":55},"Connect to a Server","\u002Fdocs\u002Fget-started\u002Fconnect-a-server",{"title":57,"url":58},"Invite your team","\u002Fdocs\u002Fget-started\u002Finvite-your-team",{"title":60,"url":61},"Create your first Agent","\u002Fdocs\u002Fget-started\u002Ffirst-agent",{"id":9,"title":10,"pages":63},[64,67,68,71,74,77,80,83],{"title":65,"url":66},"L4 on Cloudflare","\u002Fdocs\u002Fcloudflare\u002Foverview",{"title":4,"url":6},{"title":69,"url":70},"Costs and limits","\u002Fdocs\u002Fcloudflare\u002Fcosts-and-limits",{"title":72,"url":73},"Custom domain","\u002Fdocs\u002Fcloudflare\u002Fcustom-domain",{"title":75,"url":76},"Mail on Cloudflare","\u002Fdocs\u002Fcloudflare\u002Fmail",{"title":78,"url":79},"Update a Cloudflare Server","\u002Fdocs\u002Fcloudflare\u002Fupdates",{"title":81,"url":82},"Backups on Cloudflare","\u002Fdocs\u002Fcloudflare\u002Fbackups",{"title":84,"url":85},"Remove a Cloudflare Server","\u002Fdocs\u002Fcloudflare\u002Fremove-a-server",{"id":87,"title":88,"pages":89},"self-host","Self-host",[90,93,96,99],{"title":91,"url":92},"Run a Server on a VPS","\u002Fdocs\u002Fself-host\u002Fvps",{"title":94,"url":95},"Run a Server with Docker Compose","\u002Fdocs\u002Fself-host\u002Fdocker",{"title":97,"url":98},"Run a Server on Coolify","\u002Fdocs\u002Fself-host\u002Fcoolify",{"title":100,"url":101},"Compute Nodes","\u002Fdocs\u002Fself-host\u002Fcompute-nodes",{"id":103,"title":104,"pages":105},"concepts","Concepts",[106,109,112,115,118],{"title":107,"url":108},"Servers and the Shell","\u002Fdocs\u002Fconcepts\u002Fserver-and-shell",{"title":110,"url":111},"Accounts, Members and Roles","\u002Fdocs\u002Fconcepts\u002Faccounts-members-roles",{"title":113,"url":114},"Agents, Tasks and Runs","\u002Fdocs\u002Fconcepts\u002Fagents-tasks-runs",{"title":116,"url":117},"Files and backups","\u002Fdocs\u002Fconcepts\u002Ffiles-and-backups",{"title":119,"url":120},"Releases and updates","\u002Fdocs\u002Fconcepts\u002Freleases-and-updates",{"id":122,"title":123,"pages":124},"agents","Agents and MCP",[125,128,131,134,137,140],{"title":126,"url":127},"Agents overview","\u002Fdocs\u002Fagents\u002Foverview",{"title":129,"url":130},"Models and Providers","\u002Fdocs\u002Fagents\u002Fmodels-and-providers",{"title":132,"url":133},"Connect an MCP client","\u002Fdocs\u002Fagents\u002Fmcp",{"title":135,"url":136},"External agents","\u002Fdocs\u002Fagents\u002Fexternal-agents",{"title":138,"url":139},"Repositories and code work","\u002Fdocs\u002Fagents\u002Frepositories",{"title":141,"url":142},"Schedules","\u002Fdocs\u002Fagents\u002Fschedules",{"id":144,"title":145,"pages":146},"guides","Guides",[147,150,153,156,159,162],{"title":148,"url":149},"Chat","\u002Fdocs\u002Fguides\u002Fchat",{"title":151,"url":152},"Projects and Tasks","\u002Fdocs\u002Fguides\u002Fprojects-and-tasks",{"title":154,"url":155},"Mail","\u002Fdocs\u002Fguides\u002Fmail",{"title":157,"url":158},"Calls and Live","\u002Fdocs\u002Fguides\u002Fcalls",{"title":160,"url":161},"Notifications","\u002Fdocs\u002Fguides\u002Fnotifications",{"title":163,"url":164},"Telegram","\u002Fdocs\u002Fguides\u002Ftelegram",{"id":166,"title":167,"pages":168},"reference","Reference",[169,172],{"title":170,"url":171},"Glossary","\u002Fdocs\u002Freference\u002Fglossary",{"title":173,"url":174},"Troubleshooting","\u002Fdocs\u002Freference\u002Ftroubleshooting",{"title":65,"url":66},{"title":69,"url":70},1793304297751]