Secure Cloudflare Workers for Your Team | GitHub SSO & OTP Login

What if I told you that you could add enterprisegrade authentication to any Cloudflare worker in under 60 seconds? No configuration files, no authentication libraries, just a single click. In this video, I'm going to show you exactly how to do so. And we'll even take it a step further by adding GitHub single sign on. I'll start by creating a new worker using ppm create cloud for later super private worker. We'll use the hello world example worker only in TypeScript. We'll use git and we'll immediately deploy this application. After deploying, we should be able to get our URL. Let's open it up in our browser. Now, this is not a very secure Cloudflare worker. So, let's change that. I'm going to go to my Cloudflare dashboard. I'll click on compute and AI workers and pages and we should now have our super private worker. I'll then go to settings, click those three dots over here and turn on Cloudflare access. Here we have the audience tag and the JSON web key set URL that we won't need for now. They can both be retrieved later. Now let's open up our worker again. I'll refresh. As you can see, our worker is now secured by a one-time PIN code. Let's fill in my email address and send the code. I'm going to grab my phone and read the onetime PIN that I got. 712277. Sign in. There we go. In a single click, didn't I say so? Now, let's look at the access log event. I'll go to compute workers. We'll go to zero trust. And under logs, we should now have access logs. We'll filter by super private worker. We apply the filters. And there you go. We have one login event where access was granted from the US. That was me. We can do better than a one-time pin. Let's add login with GitHub and then add a policy that restricts access to members of my organization only. So in here I'll go to settings and first I want to show you on the custom pages our team domain. This team domain will be imported later. For me it is yells-youtube.cloudflare access.com. So I'll copy this. Now I go to settings authentication and under login methods I can add a new method. We'll choose GitHub. Now we'll need an app ID and a client secret. We can get those by following these instructions. So, inside of GitHub, I'm going to go to settings, scroll down until I see developer settings, oath applications, and then create a new oath application, and we'll create this super secret app. Now the homepage URL as you can see in the docs is the team domain we just copied but with the protocol in front of it. So we say https and then the domain. Next we need the authorization callback URL. That will be the same domain but there's this callback path appended to it. Now this callback URL is where GitHub will redirect us after authentication. Let's register the application. Great. I got my client ID and now I need to create a client secret and here I'll click generate new secret. And a new secret is created for me here. Let's copy it in here and save. Now when I click finish setup, we'll allow Cloudflare to read from this OOTH application data like public profile and organization membership. Okay, this is the OOTH screen. Note that I have this Yellow YouTube organization. I'm going to grant access to this organization and this will become important quickly. Now authorize myself. Success. GitHub is now set up as an identity provider. Now we've added a new identity provider. Now we just need to enable it and create a policy. So under access policies I'll create a new policy. The policy will be called GitHub organization and the action will be allowed. Then in this dropdown I should now see GitHub organization. This is because we added GitHub as an identity provider. The organization name is Yelis YouTube. and I'm going to save. Okay. Now, there's one more step we need to take. When I go to applications, super private worker, configure, and under policies, I need to select an existing policy. I'll add this GitHub organization policy we just created and save. I need to enable this new login method. So, under login methods, I should now see GitHub. Let's enable it. Notice this instant off toggle. This allows the user to skip the access screen if you only have one provider. Okay, let me save the application. So to simulate a log out, I'm going to clear my cookies. Storage cookies. Clear. And I'm going to refresh the page. Now I can click sign in with GitHub. And we're authenticated again. Isn't that amazing? In just a couple of minutes, we went from a publicly accessible worker to a protected one with organization level access control. We didn't have to write any code. Leave a comment below if you want to see the next video where we'll validate the user's JWT and access their current GitHub organization. Thanks for watching.