Cloudflare Tunnel
- 853 installs
- 76 repo stars
- Updated August 4, 2026
- vm0-ai/vm0-skills
cloudflare-tunnel is a DevOps skill that documents Cloudflare Tunnel and Cloudflare Access curl patterns for developers who need to reach local or protected APIs without opening inbound firewall ports.
About
cloudflare-tunnel is a vm0-skills integration guide for secure connectivity through Cloudflare Tunnel (also called Argo tunnel). It shows curl requests with CF-Access-Client-Id and CF-Access-Client-Secret headers against protected service URLs, including cases where services require both Cloudflare Access and their own authentication tokens such as Bearer API keys. Developers reach for cloudflare-tunnel when exposing local development servers, staging APIs, or internal tools through Cloudflare without punching firewall holes or managing VPNs. The skill fits agent workflows that test or document tunneled endpoints during deployment and remote debugging.
- Handles Cloudflare Access authentication via CF-Access-Client-Id and CF-Access-Client-Secret headers
- Supports layered authentication combining Cloudflare headers with Bearer tokens or Basic Auth
- Generates ready-to-run curl commands for GET, POST, and file download operations
- Writes request bodies to temporary files for complex JSON payloads before sending
Cloudflare Tunnel by the numbers
- 853 all-time installs (skills.sh)
- +5 installs in the week ending Aug 5, 2026 (Skillselion tracking)
- Ranked #328 of 1,039 Cloud & Infrastructure skills by installs in the Skillselion catalog
- Security screen: HIGH risk (skills.sh audit)
- Data as of Aug 5, 2026 (Skillselion catalog sync)
npx skills add https://github.com/vm0-ai/vm0-skills --skill cloudflare-tunnelAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 853 |
|---|---|
| repo stars | ★ 76 |
| Security audit | 3 / 3 scanners passed |
| Last updated | August 4, 2026 |
| Repository | vm0-ai/vm0-skills ↗ |
How do you expose local services with Cloudflare Tunnel?
Securely expose local services and APIs through Cloudflare Tunnel without opening firewall ports.
Who is it for?
Developers exposing local or staging services through Cloudflare Tunnel with Access policies who need agent-ready curl templates.
Skip if: Teams not using Cloudflare Tunnel or environments that require traditional VPN and port-forwarding without Cloudflare Access.
When should I use this skill?
The user mentions Cloudflare tunnel, Argo tunnel, or secure connectivity to local or protected services.
What you get
Authenticated curl commands, tunnel access patterns, and dual-auth request examples
- authenticated curl commands
- tunnel access documentation
- dual-auth request templates
By the numbers
- Documents 2 required Cloudflare Access headers: CF-Access-Client-Id and CF-Access-Client-Secret
Files
Usage
Basic curl Request
Add two headers to authenticate through Cloudflare Access:
curl -s \
-H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
-H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \
"https://your-protected-service.example.com/api/endpoint"With Additional Authentication
Many services require both Cloudflare Access AND their own authentication:
curl -s \
-H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
-H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \
-H "Authorization: Bearer $API_TOKEN" \
"https://your-protected-service.example.com/api/endpoint"With Basic Auth
curl -s \
-H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
-H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \
-u "username:password" \
"https://your-protected-service.example.com/api/endpoint"POST Request with JSON Body
Write to /tmp/request.json:
{
"key": "value"
}Then run:
curl -s -X POST \
-H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
-H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \
-H "Content-Type: application/json" \
-d @/tmp/request.json \
"https://your-protected-service.example.com/api/endpoint"Download File
curl -s -o /tmp/output.file \
-H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
-H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \
"https://your-protected-service.example.com/file"Skip SSL Verification (Self-signed certs)
Add -k flag for services with self-signed certificates:
curl -k -s \
-H "CF-Access-Client-Id: $CF_ACCESS_CLIENT_ID" \
-H "CF-Access-Client-Secret: $CF_ACCESS_CLIENT_SECRET" \
"https://your-protected-service.example.com/api/endpoint"Required Headers
| Header | Value | Description |
|---|---|---|
CF-Access-Client-Id | <client-id>.access | Service Token Client ID |
CF-Access-Client-Secret | <secret> | Service Token Client Secret |
Common Errors
| Error | Cause | Solution |
|---|---|---|
| 403 Forbidden | Invalid or missing headers | Check Client ID and Secret |
| 403 Forbidden | Token not in Access policy | Add token to application's Access policy |
| 401 Unauthorized | Service's own auth failed | Check service-specific credentials |
| Connection refused | Tunnel not running | Verify cloudflared is running |
Tips
1. Header order doesn't matter - CF headers can be anywhere in the request 2. Works with any HTTP method - GET, POST, PUT, DELETE, etc. 3. Combine with other auth - CF Access + Basic Auth, Bearer Token, etc. 4. Token rotation - Rotate secrets periodically in Zero Trust dashboard
API Reference
- Cloudflare Access: https://developers.cloudflare.com/cloudflare-one/identity/service-tokens/
- Zero Trust Dashboard: https://one.dash.cloudflare.com/
Related skills
Azure AiIntegrates Azure AI Content Safety, Document Intelligence, Speech, and Search services into Java-based agents and applications.495k1.4kAzure PrepareGenerate the exact Azure infrastructure files, Dockerfiles, and azure.yaml configuration needed before deploying any new or modernized application.494k1.4kAzure StorageConnect agents and applications to Azure Blob Storage, File Shares, Queues, Tables, and Data Lake without leaving the coding environment.494k1.4kAppinsights InstrumentationAutomatically instrument web applications running on Azure App Service with Application Insights for observability without manual configuration.493k1.4kAzure Resource LookupInstantly list, query, and discover any Azure resources across subscriptions without leaving the agent chat.493k1.4kAzure AigatewayConfigure Azure API Management as a secure, governed gateway for routing traffic to LLMs, MCP servers, and agent tools.493k1.4kHow it compares
Pick cloudflare-tunnel for Cloudflare Access curl patterns when tunneling local services instead of generic ngrok guides.
FAQ
Which headers authenticate cloudflare-tunnel curl requests?
cloudflare-tunnel curl requests use CF-Access-Client-Id and CF-Access-Client-Secret headers with values from environment variables to authenticate through Cloudflare Access to a tunneled service URL.
Can cloudflare-tunnel endpoints require two auth layers?
Yes. cloudflare-tunnel documents services that need both Cloudflare Access headers and their own authentication, such as an Authorization Bearer token alongside CF-Access credentials.
Is Cloudflare Tunnel safe to install?
skills.sh reports 3 of 3 security scanners passed. Review the Security Audits panel on this page before installing in production.