How to Allow Public Access to Specific Endpoints While Protecting the Rest with Zer

SSE and Zero trust Access
1

What is the name of the domain?

What is the error message?

“You need permission to access this resource” (Cloudflare Access login prompt)

What is the issue you’re encountering

I’m using Cloudflare Zero Trust Access to protect my web application hosted at files.***. However, I need certain URLs — specifically those under /share/ — to remain publicly accessible without requiring Access authentication. Currently, even those public share links are behind Access login, which breaks the sharing feature.

What steps have you taken to resolve the issue?

I’ve reviewed the Cloudflare Access documentation and found that Access policies can include Bypass rules. I attempted to create a Bypass rule with a path-based condition for /share/* but it didn’t seem to work as expected — the Access login screen still appears.

What are the steps to reproduce the issue?

  1. Set up a Cloudflare Access policy to protect all paths under files.example.com.
  2. Try visiting a public share URL like https://files.example.com/share/abc123 — you’ll be prompted to authenticate via Access.
  3. Add a policy with Bypass action for paths matching /share/* or similar.
  4. Visit the same share URL again — it still triggers the Access login screen.
2

You create a second Access Application for /share wit a Bypass policy.

3

It’s cheating and absolutely not an elegant solution :saluting_face:

4

[NEW] And actually, I’ve seen quite a few topics here, but all of them have been closed with no answer. How do I, a person who doesn’t want to link my card in Cloudflare, go to Access → Application? Sure, I’ve solved this problem using the API, but it shouldn’t work like that, right…?