IdentityProvider

Source: src/Cloudflare/Access/IdentityProvider.ts

A Cloudflare Zero Trust Access identity provider — the login method (one-time PIN, generic OIDC/SAML, or a named provider like GitHub, Google, Okta, or Azure AD) users authenticate with before Access policies evaluate.

Props are a discriminated union on type: each provider type only accepts (and requires) its own config fields, so a missing directoryId on an azureAD IdP or a GitHub config on an oidc IdP is a compile-time error. The type is immutable (config shapes are disjoint per type — changing it replaces the IdP); name, config, and SCIM settings converge in place. Cloudflare masks secret config fields (clientSecret, API tokens) on read, so those fields diff against your previously declared props instead of observed cloud state.

By default the IdP is created at the account level (the modern Zero Trust organization scope); pass zoneId to scope it to a single zone (legacy zone-level Access). Moving between scopes replaces the IdP.

Creating an Identity Provider

One-time PIN (no external dependencies)

const otp = yield* Cloudflare.Access.IdentityProvider("Pin", {
  type: "onetimepin",
});

Generic OIDC provider

const oidc = yield* Cloudflare.Access.IdentityProvider("Sso", {
  type: "oidc",
  config: {
    clientId: "my-client-id",
    clientSecret: "my-client-secret",
    authUrl: "https://idp.example.com/authorize",
    tokenUrl: "https://idp.example.com/token",
    certsUrl: "https://idp.example.com/keys",
    scopes: ["openid", "email", "profile"],
  },
});

Microsoft Entra ID (Azure AD)

const entra = yield* Cloudflare.Access.IdentityProvider("Entra", {
  type: "azureAD",
  config: {
    clientId: "my-client-id",
    clientSecret: "my-client-secret",
    directoryId: "my-tenant-id",
    supportGroups: true,
  },
});

Zone-scoped IdP (legacy zone-level Access)

const zoneIdp = yield* Cloudflare.Access.IdentityProvider("ZoneSso", {
  zoneId: zone.zoneId,
  type: "github",
  config: {
    clientId: "my-client-id",
    clientSecret: "my-client-secret",
  },
});

Restricting an Application to an IdP

yield* Cloudflare.Access.Application("Admin", {
  domain: "admin.example.com",
  allowedIdps: [oidc.identityProviderId],
});