Keep machine access authenticated instead of creating a Cloudflare Access Bypass

Bypass removes Access enforcement and its request logging for matching traffic.

Source facts

Cloudflare documents Bypass as disabling Access enforcement for matching traffic. Such traffic does not receive Access security controls and its requests are not logged by Access. Bypass also does not support identity-based selectors. Service Auth is a different action for authentication without an identity-provider login, including service tokens or mutual TLS. Access remains deny by default for traffic that does not satisfy an allowing policy; a Block rule alone does not grant everybody else entry. These actions therefore solve materially different access requirements.

Source: Cloudflare — Access policies.

Applicability

This applies to Cloudflare Access application policies. Zone security settings may still apply to bypassed traffic, but they do not supply the Access identity enforcement removed by the Bypass action.

DSE recommendation

DSE recommends documenting why an endpoint needs public access or machine authentication before selecting an action. Use a narrowly defined service-authentication design for automation that can present approved credentials. Reserve any public exception for the exact endpoint and business purpose reviewed by its owner. Check overlapping policies and application paths before saving. Keep an exception register with an owner and expiry review, and verify the resulting evidence trail rather than assuming a bypassed request will appear beside authenticated requests.

Verification

In a test application, compare an authorized automation request, a request with missing credentials, and an unrelated path. Review the actual policy decision and available logs. Confirm that a public exception exposes only the intended resource and remove the test exception afterward.

Official reference

Cloudflare — Access policies. Reviewed October 15, 2026.