Before I submit a Cloudflare support ticket, I’d thought I would check here first in case others may have this issue.
I have hired a developer for on-going support for my VPS.
We are separated by three time zones. He needed access to my CloudFlare account which I am OK in giving him the credentials to get in, however because Cloudflare didn’t recognize his IP address, he was presented with a token challenge which was sent to my primary email address.
I said all of that to ask this: Is there a way I can add his device IP address to my account so he won’t get the challenge when he log in?
At this point I’d change the password (and change it everywhere else where you might use the same password) and use mentioned invitation system to grant him access.
Should you really want to continue with the password sharing approach though, then no, you can’t whitelist his address, however once you confirmed it once he should be probably good for that particular address. Again, I really do advise against that however.