---
outline: deep
---
# Cloudflare Access OAuth2 Configuration
If you encounter issues logging in as an administrator using Github, Gitlab, or Gitee, you may consider switching to Cloudflare Access as the OAuth2 provider.

## Example Configuration:

```yaml
Oauth2:
  Admin: 701b9ea6-9f56-48cd-af3e-cbb4bfc1475c
  ClientID: 3516291f53eca9b4901a01337e41be7dc52f565c8657d08a3fddb2178d13c5bf
  ClientSecret: 0568b67c7b6d0ed51c663e2fe935683007c28f947a27b7bd47a5ad3d8b56fb67
  Endpoint: "https://xxxxx.cloudflareaccess.com"
  Type: cloudflare
```

## Configuration Description:

| Parameter             | Retrieval Method                                                                |
|-----------------------|---------------------------------------------------------------------------------|
| Admin                 | `My Team` -> `Users` -> `<specific user>` -> `User ID`                          |
| ClientID/ClientSecret | `Access` -> `Application` -> `Add an Application` <br/> -> `SaaS` -> `OIDC`     |
| Endpoint              | `Access` -> `Application` -> `Application URL` -> `Only keep the protocol and domain, no path` |

### Setting Up a New SaaS-OIDC Application

Navigate to the Zero Trust Dashboard: [https://one.dash.cloudflare.com/](https://one.dash.cloudflare.com/). Choose or create a new account, then follow these steps:

1. Go to `My Team` -> `Users` -> Click `<specific user>` -> Obtain and save the `User ID`. *(If this is your first time using Zero Trust, the Users list will be empty, and you can skip this step; users will appear after completing a verification.)*
2. Navigate to `Access` -> `Applications` -> `Add an Application`.
3. Select `SaaS`. In the `Application` field, enter a custom application name (e.g., `nezha`), select `OIDC`, and then click `Add application`.
4. For `Scopes`, select `openid`, `email`, `profile`, `groups`.
5. In `Redirect URLs`, enter your Dashboard Callback URL, such as `https://dashboard.example.com/oauth2/callback`.
6. Record the `Client ID`, `Client Secret`, and the protocol and domain part of the `Issuer` address, for example, `https://xxxxx.cloudflareaccess.com`.
7. Edit the Dashboard configuration file (usually located at `/opt/nezha/dashboard/data/config.yaml`), adjust the `OAuth2` settings according to the example configuration, and restart the Dashboard service.

### Identity Verification Strategy Configuration

After setting up the Dashboard, you need to configure identity verification policies in the Zero Trust Dashboard. Navigate to: `Access` -> `Applications` -> `<application name>` -> `Policies`. You can choose from various SSO authentication methods, including email OTP and hardware key verification. For detailed configurations, refer to the [Cloudflare Zero Trust Documentation](https://developers.cloudflare.com/cloudflare-one/).

### Policy Configuration Example (One-time PIN)

Using email OTP as the default verification method:

1. Navigate to `Access` -> `Applications` -> `<application name>` -> `Policies` -> `Add a policy`.
2. Set a `Policy Name`, for example, `OTP`, and set `Action` to `Allow`.
3. Under `Configure rules`, add a new `Include` rule. Select `Emails` as the `Selector` and enter your email address in the textbox.
4. Click `Save policy` to save the configuration.

### Testing the Policy

1. If the configuration is correct, when you visit the Dashboard login interface, it will display as "Log in with Cloudflare Account." Clicking on login will redirect you to the Cloudflare Access login page.
2. Enter the email address configured previously, click `Send me a code`, and then enter the code received to log in to the Dashboard.
3. If `User ID` was not specified in `Admin` during previous steps, an error message will be displayed after login: "This user is not an administrator of this site and cannot log in." At this point, you need to go to `My Team` -> `Users`, find the corresponding user, click on the username to get the `User ID`, and enter it into the `Admin` section of the Dashboard configuration file. After restarting the Dashboard service, try logging in again.