Temporary Authentication brings human approval into Zero Trust policies
Cloudflare Access is adding a new layer of control for applications that need more than just automated policy checks. Starting today, administrators can configure Access policies that require temporary authentication — a flow where a user's access request must be explicitly approved by a predefined set of administrators. This gives teams a way to introduce human oversight without dismantling existing Zero Trust rules.
The feature can be applied to any resource protected by Cloudflare Access, whether it's a SaaS application or a self-hosted service. Policies continue to evaluate the usual Zero Trust signals first; temporary authentication adds an approval step on top when you need it.
Why temporary access matters
Most organizations start by provisioning application access per user, typically by username or email. That approach creates continuous manual work as employees join, change roles, or leave. The next step is usually identity provider (IdP) groups mapped to roles, which simplifies things but introduces new problems. When a support representative needs occasional access to an engineering tool, for example, they get added to an existing group or a new group is created for that specific need. Since that access was meant to be temporary, the user is rarely removed afterward — leaving behind overprovisioned groups that live on indefinitely.
In practice, most applications have two user populations: those who access them daily as part of their job, and those who need access only periodically. Temporary authentication targets the second group, and it also makes sense for highly sensitive resources — like production databases — where no user should have persistent access at all.
Building on Purpose Justification
Cloudflare Access already offered Purpose Justification, which prompts users to provide a business reason before reaching a protected application. That gave administrators an audit trail and reminded users to only connect with good reason, but it couldn't deny access on its own.
Temporary Authentication extends this functionality. Now a user's justification — along with their location and IP address — is forwarded to a preconfigured list of approvers. Those approvers can approve or deny the request, or grant access for a limited duration. This approach avoids the two extremes: over-provisioning sensitive applications on one hand, and creating an approval bottleneck with a small group of credentialed employees on the other. Every request and approval is logged for audit and compliance purposes.
Built on Workers, flexible by design
Both Purpose Justification and Temporary Authentication are implemented on Cloudflare Workers. That means user requests and administrator reviews are rendered from the closest data center to the user, which keeps interactive approval flows responsive even when the approver is geographically distant from the requester.
The Workers foundation also makes the enforcement logic flexible. For instance, you can require a user who normally has persistent access to undergo temporary authentication when connecting from a personal device or from a high-risk country.
Getting started
To configure Temporary Authentication, navigate to the Teams Dashboard and create an Access application. In the application's Zero Trust policy, specify when temporary authentication with human approval should be enforced. Developers can find more detailed guidance in the Cloudflare developer documentation.
