Cloudflare — scoped API-Token (Writes) + OAuth-IdP-Secrets
Cloudflare wird wie jeder andere Dienst im Repo über einen scoped API-Token geschrieben
(Konvention wie mcp/portainer, mcp/omada). Die cloudflare-OAuth-MCP in Claude Code ist
read-only (Consent bietet keinen Write-Scope) → nur zum Lesen.
Plan/Kontext: ~/.claude/plans/schei-e-wenn-ich-das-breezy-biscuit.md · SSoT: docs/cf-tunnel-mapping.md.
1. API-Token anlegen
dash.cloudflare.com → My Profile → API Tokens → Create Token → Create Custom Token
- Permissions:
- Account · Cloudflare Tunnel · Edit
- Zone · DNS · Edit
- Account · Access: Apps and Policies · Edit
- Account · Access: Organizations, Identity Providers, and Groups · Edit
- Account Resources: Include → Christoph@emsenhuber.com's Account
- Zone Resources: Include → Specific zone → emsenhuber.net
- Create → Token kopieren → in
.envalsCF_API_TOKEN.
2. OAuth-Apps für Access-Login (Callback überall gleich)
Callback-URL: https://emsenhuber.cloudflareaccess.com/cdn-cgi/access/callback
- GitHub (reparieren — Secret fehlt): github.com → Settings → Developer settings → OAuth Apps
→ bestehende App (client_id
Ov23li2h96hAkGRPJXYV) → Generate a new client secret → Authorization callback URL = obige Callback-URL → Secret in.env(GITHUB_CLIENT_SECRET). - Google: console.cloud.google.com → APIs & Services → Credentials → Create OAuth client ID →
Web application → Authorized redirect URI = Callback-URL → client_id/secret in
.env. - Facebook: developers.facebook.com → Create App → Facebook Login → Valid OAuth Redirect URI =
Callback-URL → App-ID/Secret in
.env.
3. Geli
GELI_EMAIL (für Social-Login-Policy). GELI_PUBLIC_IP nur falls stabile öffentliche IPv4 (CGNAT → leer).
4. Ausführung
Writes laufen per curl gegen api.cloudflare.com mit Authorization: Bearer $CF_API_TOKEN
(set -a; . mcp/cloudflare/.env; set +a). Claude wendet die Change-Sets aus dem Plan an und
verifiziert jeden Schritt extern (HTTP-Status, kein 1033). Reihenfolge: Token-Verify → Track A
(Tunnel) → Track B (Access).