cloudflare-tunnel — Claude Code skill: reach services behind Access
A skill that hands the agent working curl recipes for services protected by Cloudflare Access, using a service token and its two headers.
npx skills add okou-ai/okou-skills --skill cloudflare-tunnel -a claude-codeWhat cloudflare-tunnel does
Use it when an endpoint sits behind a Cloudflare Access policy and you need to call it from the shell. The skill gives the agent the header pair to attach: CF-Access-Client-Id and CF-Access-Client-Secret, with the client ID ending in .access.
Recipes cover GET, a POST that reads its JSON body from /tmp/request.json, saving a response to /tmp/output.file, basic auth via -u, and stacking a service Authorization: Bearer on top. A troubleshooting table maps 403 to bad headers or a token missing from the Access policy, 401 to the service's own credentials, and a refused connection to cloudflared not running.
You need a service token from Zero Trust and cloudflared on the host. The -k flag switches off certificate checks for self-signed setups; leave it on and a man in the middle goes unnoticed, so fix the cert instead when it matters.
What it helps with
- call an Access-protected API from
curl - send a POST with a JSON body to a gated service
- download a file from a host behind an Access policy
- pair a Cloudflare service token with a Bearer token
- diagnose a 403 or 401 response
Example prompts for the agent
- Fetch
https://your-protected-service.example.com/api/endpointthrough Cloudflare Access and show me the response - POST the body in
/tmp/request.jsonto the protected endpoint - I keep getting 403 from the service behind Cloudflare — work out why
How to install cloudflare-tunnel
1Skills CLI (Vercel)
npx skills add okou-ai/okou-skills --skill cloudflare-tunnel -a claude-code2Manually: put the files in place
~/.claude/skills/cloudflare-tunnel/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/cloudflare-tunnel/
1Skills CLI (Vercel)
npx skills add okou-ai/okou-skills --skill cloudflare-tunnel -a codex2Manually: put the files in place
.agents/skills/cloudflare-tunnel/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add okou-ai/okou-skills --skill cloudflare-tunnel -a cursor2Manually: put the files in place
.cursor/skills/cloudflare-tunnel/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install okou-ai/okou-skills cloudflare-tunnel2Manually: put the files in place
.github/skills/cloudflare-tunnel/SKILL.md1Skills CLI (Vercel)
npx skills add okou-ai/okou-skills --skill cloudflare-tunnel -a gemini-cli2Platform CLI
gemini skills install https://github.com/okou-ai/okou-skills --path cloudflare-tunnelManually: put the files in place
.devin/skills/cloudflare-tunnel/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add okou-ai/okou-skills --skill cloudflare-tunnel -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about cloudflare-tunnel
How do I install cloudflare-tunnel in Claude Code?
Run npx skills add okou-ai/okou-skills --skill cloudflare-tunnel -a claude-code. The skill lands at ~/.claude/skills/cloudflare-tunnel/SKILL.md.
What does cloudflare-tunnel do?
It supplies the agent with request patterns for Cloudflare Access-protected services and a table of common failures with their causes.
What do I need before it works?
A Cloudflare service token (client ID and secret) plus a running cloudflared; with no tunnel up, requests end in connection refused.
