CF Pages POC — Cloudflare Pages + Access

1 · Cloudflare Access

You would not be reading this if Access had not already let you in. This calls /api/whoami, which shows what the Worker sees in the Cf-Access-Jwt-Assertion header.

Access identity: unknown

2 · Okta sign-in (PKCE)

The Access session gets you to the page. The AWS API needs a separate Okta access token, which this SPA fetches with authorization code + PKCE. Pick the scopes that match your Okta group before signing in — Okta rejects the whole login if you request a scope your group is not allowed.

Scopes to request api:dog — GET /dog · groups api-dog-only, api-full-access api:dog2 — GET /dog2 · group api-full-access only

Okta: signed out

Access token claims

3 · Public leg — AWS API Gateway + Lambda

Worker forwards your Okta bearer token to the api-auth-test REST API. The Lambda TOKEN authorizer validates it and checks scopes, so /dog2 is a 403 for api-dog-only users.

4 · Private leg — Cloudflare Tunnel → AKS

Worker attaches an Access service token and calls the tunnel hostname. Your Okta token is not involved — this leg works whether or not you are signed in to Okta.

Change the path to whatever your AKS test app actually serves. The Worker rewrites /api/private/<path> to https://cfpoc-api.dev-csoki.com/<path>.

Response

No request sent yet.