Cloudflare Access reference

Answer first

ERPipe's Cloudflare Access configuration is an optional credential pair on an Odoo connection. It adds CF-Access-Client-Id and CF-Access-Client-Secret to Odoo requests. It does not replace Odoo authentication or grant additional Odoo permissions. For the sequence of dashboard steps, use the Odoo Cloudflare Access setup guide.

This reference applies to releases exposing the Cloudflare Access card and the operations below. Check the connection's Configure page before following a workflow on an older deployment. Generic custom headers and browser-based Access login are not configuration options in this feature.

Credentials and request boundaries

Cloudflare documents the two service-token headers in its service-token reference. Odoo 19 JSON-2 uses a separate bearer credential, described in the official Odoo API reference.

For hosted ERPipe, the destination must pass public HTTPS and DNS validation. A service token does not make a private-only origin routable. JSON-2 authentication, its version probe and XML-RPC calls all receive the configured pair. Redirects are not followed. Odoo ACLs, field policies, write settings and approvals continue to apply.

Fields and validation

Both input values must be strings containing 1–512 visible ASCII characters after surrounding spaces are removed. Control characters, newlines, non-ASCII characters and internal whitespace are rejected. Supply both or omit both during creation. The wizard omits its unused blank fields; explicitly sending empty or partial values to the API is invalid. Set/replace always requires a complete pair.

The Access secret is encrypted with a connection-specific context separate from the Odoo credential. Saved Client IDs, secrets and encrypted values are not returned in public connection responses. Logs and audit handling redact Access credential fields. A configured flag reports stored configuration, not proof that the token remains valid after expiry or policy changes.

Owner permissions and connection states

Only a current owner of the connection's workspace can configure Access. Dashboard/API operations require the authenticated owner session. MCP Access configuration additionally requires erpipe:write; creating an instance with an Access pair also requires owner access. Odoo writes can stay disabled throughout token setup.

A paused connection can have its token replaced. The operation preserves its paused status. A revoked connection rejects configuration changes. Verification that overlaps another credential update, revocation or loss of ownership can return 409; reload before deciding whether to retry.

API operations

Use the authenticated ERPipe application API. Browser integrations must preserve the existing same-origin/session protections. Never place a session cookie or credential in a public example, query string or analytics event.

Here is the response shape for a successful set operation; the identifiers are illustrative:

{
  "ok": true,
  "connection": {
    "id": "connection-id",
    "instance": "your-instance-key",
    "cloudflare_access_configured": true
  }
}

A successful clear returns the same shape with cloudflare_access_configured: false. Connection lists and details expose the flag as well. Replacing the Access pair does not require sending another Odoo password.

MCP operations

create_instance accepts the optional pair alongside its normal connection inputs. update_instance_cloudflare_access manages an existing connection:

Credential-bearing setup is best completed in the dashboard. Automated integrations must obtain secrets through their own protected runtime inputs; do not paste them into an agent conversation. MCP success reports success: true, connection identifiers and configured status. The public tool catalog describes the rest of the surface.

Errors and recovery

API errors use the existing error and message envelope. The user-facing message omits saved secrets. A failed set or clear leaves the saved credential pair unchanged.

Missing authentication is handled by the application's normal session gate. For upstream redirects and proxy 403 responses, follow setup troubleshooting. More-specific Cloudflare application-path policies can explain why an ORM call works while version discovery is denied.

Replacement and removal

Set/replace checks the new pair with the existing Odoo credential before saving it. A failed check, concurrent change or permission loss does not authorize replacing the previous verified state. After a successful replacement, perform a small Odoo read before revoking an old token during planned rotation.

If both credentials have changed or expired, expand Odoo credential also changed? on Configure and supply the new Odoo password/API key with the new Access pair. The API and MCP set operation accepts the same optional password field. Both credentials are verified together and saved in one conditional update; an invalid replacement, failed check or concurrent update preserves the previous stored bytes. This recovery does not require decrypting obsolete credentials when both are replaced. It preserves the connection identity, paused state and write controls.

Clear checks the same Odoo credential without Access headers. When Cloudflare still blocks that request, the operation returns 422 and retains the saved token. Clearing ERPipe's copy does not change the Cloudflare policy or revoke the token in Cloudflare. Manage Cloudflare's token lifecycle in Cloudflare and keep the integration's saved pair current.

Self-host configuration

The TypeScript self-host Worker accepts CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET together. Leave both unset for a connection that does not use Access. Use interactive secret prompts in the self-host package:

npx wrangler secret put CF_ACCESS_CLIENT_ID
npx wrangler secret put CF_ACCESS_CLIENT_SECRET

Core consumers can supply the typed cfAccess object with clientId and clientSecret loaded from their own secret store. Access-capable packages in this implementation are core 0.1.3 and XML-RPC 0.1.2; verify the installed build supports them rather than assuming registry publication. Partial or empty self-host environment configuration fails before a request is sent.

Sources and related documentation

This contract was updated against the ERPipe implementation on September 29, 2026. External configuration references are linked above. No customer hostname, credential or live-policy test result is included here.

Continue with the setup walkthrough, connector documentation, security boundaries and compatibility matrix.