GetIdentityProvider

Source: src/Cloudflare/Access/GetIdentityProvider.ts

Looks up an existing Access identity provider by display name and/or type, returning its attributes — or undefined when nothing matches.

As a data source, invoke it at plan time via getIdentityProvider — the result is an Output resolved during plan/deploy and inert inside deployed bundles. Useful for referencing IdPs that are managed outside the stack (e.g. the dashboard-provisioned cloudflare WARP login method, whose display name is often ""). The implementation is registered by Cloudflare.providers().

As a runtime binding inside a Worker, provide GetIdentityProviderHttp — it mints a scoped AccountApiToken with the Access: Organizations, Identity Providers, and Groups Read permission and binds it into the Worker so the lookup can run at runtime.

Looking Up Identity Providers

Restrict an Access application to the managed WARP IdP

const warpIdp = Cloudflare.Access.getIdentityProvider({
  type: "cloudflare",
});

yield* Cloudflare.Access.Application("Admin", {
  domain: "admin.example.com",
  allowedIdps: [warpIdp.identityProviderId.as<string>()],
});

Look up an IdP by display name

const okta = Cloudflare.Access.getIdentityProvider({ name: "Okta SSO" });

Look up an IdP at runtime inside a Worker

// init — bind the lookup
const findWarpIdp = yield* Cloudflare.Access.GetIdentityProvider({
  type: "cloudflare",
});

// runtime — resolve the IdP
const warp = yield* findWarpIdp();