How to allow certain external API callbacks to go through Cloudflare Access?


I’m building an application with Google SSO and certain external API usage. They all have API callbacks in the flow (E.g., Google SSO callbacks to my endpoint). With Cloudflare Access at the front of my application, these API callbacks are blocked by Cloudflare Access and inherently, break the application.

With that said, what is the common strategy to allow API callbacks? A sample guide to using it with Google SSO would be great!

Thank you.

Now I think the issue is more than that. If there is a portal in front of the application going to my website immediately shows this error in the log.

I did try to exclude the path of SSO callback based on the instruction in this thread: Cloudflare Access? Exclude Path from authentication? - #5 by rushpl, but still not working.

I was really hoping that the first suggested help on Google was going to point to an actual article showing me how to accomplish this. Did you ever figure out how to do this?

You can allowlist your server IP block or address so your services can bypass Cloudflare Access.

If you are using a managed or serverless solution, you can:

  • Create a proxy API.
  • Make your client request to that proxy.
  • That proxy has access to the service auth token, which can bypass Cloudflare Access.

If you want public access, then allowlist the whole URL path.