Configure Cloudflare as Reverse Proxy

Documentation Index

Fetch the complete documentation index at: https://auth0.com/llms.txt

Use this file to discover all available pages before exploring further.

​

Configure Cloudflare

1. Configure and verify a Custom Domain with Self-Managed Certificates if you haven’t already. Make note of the Origin Domain Name and cname-api-key values since you’ll need these later.
2. In the Cloudflare dashboard for the target zone, create a CNAME record with the following settings:

   Setting	Value
   Name	The custom domain name.
   Target	The Origin Domain Name value recorded earlier.
   Proxy Status	Proxied

3. Create a Page Rule scoped to all URLs under the chosen custom domain and with the following settings:

   Setting	Value
   Host Header Override	The Origin Domain Name value recorded earlier.
   True-Client-IP	Enable

4. Create a Transform Rule:
   While it is possible to use Cloudflare Workers instead of Page and Transform rules to set up a reverse proxy that meets the requirements for a self-managed certificate custom domain, we recommend using the rules-based approach because it eliminates the need for custom code.
   1. Switch to the Modify Request Header view.
   2. Select Create Rule and provide a name of your choice.
   3. Under When incoming requests match, select Custom filter expression and set an expression that scopes the Rule to requests associated with the chosen custom domain. For example, use an exact match on the Hostname field.
   4. Under Modify request header, select Set static, and then set the following fields:

      Field	Value
      Header name	cname-api-key
      Value	The cname-api-key value recorded earlier.

5. Ensure that Always Use HTTPS is enabled and encryption mode is set, at least, to Full for your chosen custom domain.

​

Use Managed Challenges

​

Universal Login browser-based endpoints

​

Endpoints to exclude

​

Example rule

(http.host eq "YOUR_CUSTOM_DOMAIN" and (
  http.request.uri.path eq "/authorize" or
  starts_with(http.request.uri.path, "/u/") or
  http.request.uri.path eq "/login"
))

​

Configure Auth0

{
  "custom_client_ip_header": "true-client-ip"
}

​

Learn more

• Configure Features to Use Custom Domains
• Troubleshoot Custom Domains
• TLS (SSL) Versions and Ciphers