cloudflare-zero-trust-access

JWT validation with Cloudflare Zero Trust Access involves configuring your ACCESS_TEAM_DOMAIN and ACCESS_AUD environment variables, then using either Hono middleware for automatic validation or manual JWT verification templates. The Skill provides integration patterns for both approaches, enabling you to authenticate requests and enforce access control at the application level.

Yes. Zero Trust Access integrates with CORS by applying careful header ordering—CORS headers must be set before Access preflight requests are blocked. The Skill includes CORS-first patterns that demonstrate correct ordering and preflight handling to prevent authentication conflicts with cross-origin requests.

Service tokens enable machine-to-machine authentication by allowing applications and services to authenticate directly to your Workers without user interaction. The Skill provides service token authentication templates that show how to configure and validate service tokens for automated, inter-service communication.

Hono middleware automatically validates JWT tokens and handles authentication transparently within your route handlers, reducing boilerplate. Manual JWT validation gives you explicit control over token verification logic and custom claim inspection. The Skill includes templates for both, letting you choose based on your complexity and control needs.

Yes. The Skill includes advanced multi-tenant and RBAC patterns that leverage JWT claims and custom routing logic to isolate tenant data and enforce role-based permissions. These patterns enable fine-grained access control across multiple tenants within a single Cloudflare Worker deployment.

You must configure ACCESS_TEAM_DOMAIN (your Cloudflare Access team domain) and ACCESS_AUD (the application's audience identifier) as environment variables. The Skill's quick start guides you through this setup, which is required for JWT validation and token verification to function correctly.