# Cloudflare Access — Exact Setup

This follows the source document's architecture while reflecting current Cloudflare terminology.

## 1. Put the domain on Cloudflare

- Add `letstalkipdaphne.com` to Cloudflare.
- Use the nameservers Cloudflare provides at the registrar.
- Ensure the relevant DNS records are proxied.
- Use HTTPS end-to-end.

## 2. Create the Access application

Current Cloudflare dashboard path:

`Zero Trust → Access controls → Applications → Create new application → Self-hosted`

Create a public hostname for:

- `letstalkipdaphne.com`
- `www.letstalkipdaphne.com`

For the whole apex domain, leave the path empty so all paths are covered.

## 3. Configure OTP

Enable One-time PIN as an identity provider.

Create an Allow policy:

- Action: Allow
- Include: exact approved email addresses
- Require: One-time PIN

Example:

- client1@gmail.com
- client2@yahoo.com
- client3@company.com

Do NOT make `One-time PIN` alone the Include condition. That would allow arbitrary email addresses.

## 4. Session duration

Choose a session duration appropriate to the client relationship. The source document suggests roughly 1–4 hours.

## 5. Origin protection

Cloudflare Access is not a substitute for origin protection. Prefer Cloudflare Tunnel where practical, or firewall the origin to Cloudflare traffic. Keep the origin inaccessible through a directly exposed IP where possible.

## 6. Webhook exception

Do not put `/api/paystack/webhook.php` behind the client login. Paystack must be able to reach it.

Protect it with:

- HTTPS
- POST-only
- `x-paystack-signature` HMAC SHA512 verification
- idempotent payment processing
- logging
- rate limiting at the web server/WAF
- no sensitive data in the response

## 7. Validate

Test:

1. Unapproved email cannot enter.
2. Approved email receives OTP.
3. OTP expires/works only once.
4. Forwarded URL does not bypass Access.
5. Direct origin IP does not expose the application.
6. Webhook still reaches the endpoint.