How do I install the Cloudflare Tunnel skill?

Run npx skillmds add om-scogo/cloudflare-tunnel in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Cloudflare Tunnel safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cloudflare Tunnel?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cloudflare Tunnel free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cloudflare Tunnel?

om-scogo (@om-scogo) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cloudflare Tunnel by om-scogo — Agent Skill

Name: Cloudflare Tunnel
Rating: 4.2 (5 reviews)
Author: om-scogo

File contents

Usage

Basic curl Request

Add two headers to authenticate through Cloudflare Access:

curl -s \
  -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
  -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \
  "https://your-protected-service.example.com/api/endpoint"

With Additional Authentication

Many services require both Cloudflare Access AND their own authentication:

curl -s \
  -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
  -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \
  -H "Authorization: Bearer $API_TOKEN" \
  "https://your-protected-service.example.com/api/endpoint"

With Basic Auth

curl -s \
  -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
  -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \
  -u "username:password" \
  "https://your-protected-service.example.com/api/endpoint"

POST Request with JSON Body

Write to /tmp/request.json:

{
  "key": "value"
}

Then run:

curl -s -X POST \
  -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
  -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \
  -H "Content-Type: application/json" \
  -d @/tmp/request.json \
  "https://your-protected-service.example.com/api/endpoint"

Download File

curl -s -o /tmp/output.file \
  -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
  -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \
  "https://your-protected-service.example.com/file"

Skip SSL Verification (Self-signed certs)

Add -k flag for services with self-signed certificates:

curl -k -s \
  -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
  -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \
  "https://your-protected-service.example.com/api/endpoint"

Required Headers

Header	Value	Description
`CF-Access-Client-Id`	`<client-id>.access`	Service Token Client ID
`CF-Access-Client-Secret`	`<secret>`	Service Token Client Secret

Common Errors

Error	Cause	Solution
403 Forbidden	Invalid or missing headers	Check Client ID and Secret
403 Forbidden	Token not in Access policy	Add token to application's Access policy
401 Unauthorized	Service's own auth failed	Check service-specific credentials
Connection refused	Tunnel not running	Verify cloudflared is running

Tips

Header order doesn't matter - CF headers can be anywhere in the request
Works with any HTTP method - GET, POST, PUT, DELETE, etc.
Combine with other auth - CF Access + Basic Auth, Bearer Token, etc.
Token rotation - Rotate secrets periodically in Zero Trust dashboard

API Reference

Cloudflare Access: https://developers.cloudflare.com/cloudflare-one/identity/service-tokens/
Zero Trust Dashboard: https://one.dash.cloudflare.com/

---name: cloudflare-tunneldescription: Cloudflare Tunnel API for secure tunnels. Use when user mentions "Cloudflare tunnel", "argo tunnel", or secure connectivity.---## Usage### Basic curl RequestAdd two headers to authenticate through Cloudflare Access:```bashcurl -s \ -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \ -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \ "https://your-protected-service.example.com/api/endpoint"```### With Additional AuthenticationMany services require both Cloudflare Access AND their own authentication:```bashcurl -s \ -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \ -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \ -H "Authorization: Bearer $API_TOKEN" \ "https://your-protected-service.example.com/api/endpoint"```### With Basic Auth```bashcurl -s \ -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \ -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \ -u "username:password" \ "https://your-protected-service.example.com/api/endpoint"```### POST Request with JSON BodyWrite to `/tmp/request.json`:```json{ "key": "value"}```Then run:```bashcurl -s -X POST \ -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \ -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \ -H "Content-Type: application/json" \ -d @/tmp/request.json \ "https://your-protected-service.example.com/api/endpoint"```### Download File```bashcurl -s -o /tmp/output.file \ -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \ -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \ "https://your-protected-service.example.com/file"```### Skip SSL Verification (Self-signed certs)Add `-k` flag for services with self-signed certificates:```bashcurl -k -s \ -H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \ -H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \ "https://your-protected-service.example.com/api/endpoint"```## Required Headers| Header | Value | Description ||--------|-------|-------------|| `CF-Access-Client-Id` | `<client-id>.access` | Service Token Client ID || `CF-Access-Client-Secret` | `<secret>` | Service Token Client Secret |## Common Errors| Error | Cause | Solution ||-------|-------|----------|| 403 Forbidden | Invalid or missing headers | Check Client ID and Secret || 403 Forbidden | Token not in Access policy | Add token to application's Access policy || 401 Unauthorized | Service's own auth failed | Check service-specific credentials || Connection refused | Tunnel not running | Verify cloudflared is running |## Tips1. **Header order doesn't matter** - CF headers can be anywhere in the request2. **Works with any HTTP method** - GET, POST, PUT, DELETE, etc.3. **Combine with other auth** - CF Access + Basic Auth, Bearer Token, etc.4. **Token rotation** - Rotate secrets periodically in Zero Trust dashboard## API Reference- Cloudflare Access: https://developers.cloudflare.com/cloudflare-one/identity/service-tokens/- Zero Trust Dashboard: https://one.dash.cloudflare.com/

Frequently asked questions