Project Zero Trust
You need an administrator session for these commands. See Platform Management for choosing a platform, previews and confirmation.
On this pageProtect projects with Cloudflare Access · Review Zero Trust settings · Fix Access applications changed in the dashboard
This section sets the installation-wide Cloudflare Access policy and project overrides.
Run every step in one terminal
The configure command reads $ACCESS_API_TOKEN from your shell. Load it from your secret manager into an environment variable, then run all steps on this page in that same terminal window.
Step 1. Check the current state and configure Zero Trust. The second command uses ACCESS_API_TOKEN from your shell.
Requires: platform admin login
These commands need an admin session from void platform auth login. Automation uses VOID_OPERATOR_TOKEN from a secret store. Never put it in project files.
void platform zero-trust status [--check]
printf '%s' "$ACCESS_API_TOKEN" | void platform zero-trust configure \
--identity-providers <id[,id...]> \
--policies <id[,id...]> \
[--existing-projects <protected|public>] \
[--protect-new-projects] \
--token-stdin \
--yesExample output: The requested record, list, or a confirmation. Commands with --plan show the change without applying it. A summary of the applied identity providers and policies.
Step 2. Resume a stalled change, or turn Zero Trust off.
void platform zero-trust reconcile
void platform zero-trust disableExample output: the requested record, list, or a confirmation. Commands with --plan show the change without applying it.
Step 3. Check or protect one project. Use a project ID from void platform project list.
void platform zero-trust project-status <project-id>
void platform zero-trust project-protect <project-id>Example output: the requested record, list, or a confirmation. Commands with --plan show the change without applying it.
Step 4. Make the same project public, or repair its drift. Use the project ID from step 3.
void platform zero-trust project-public <project-id>
void platform zero-trust project-reconcile <project-id>Example output: the requested record, list, or a confirmation. Commands with --plan show the change without applying it.
New installations set app access in void platform install. Use these commands to check or change it later. For public-only rules in a Default-Deny account, leave out identity policies and use --public-apps.
Step 5. Configure or renew public-only rules. This uses ACCESS_API_TOKEN from the same terminal as step 1.
printf '%s' "$ACCESS_API_TOKEN" | void platform zero-trust configure \
--public-apps --token-stdin --yesExample output: a summary of the applied identity providers and policies.
Add --existing-projects public when you enable from a disabled config. Public-only rules cannot be combined with protected project choices. To switch a protected config to public-only rules, disable it first. In a Default-Deny account, Access may block traffic during the switch.
Changes support --plan, --yes and --timeout. Use --plan instead of --yes to see the change without applying it. The Access management token is only accepted on stdin. Zero Trust uses the Cloudflare account that hosts the platform.
Leave out --protect-new-projects to make new projects public by default. --existing-projects is required when you enable Zero Trust. It is rejected once Zero Trust is on. Later config changes keep each project's protection. status reports the saved state. --check also compares it with Cloudflare Access. If status stays configuring or disabling, run void platform zero-trust reconcile to resume. Protected projects support up to 100 custom domains.
The token needs Access: Apps and Policies Write and Access: Organizations, Identity Providers, and Groups Read, scoped to the platform's Cloudflare account. Select at least one Allow policy that matches people by identity. The platform rejects Bypass and Service Auth policies. It also rejects rules that allow Everyone or any service token. See Project Zero Trust for requirements and recovery.
