2. Turn on Cloudflare Access

Cloudflare Access is the login page in front of your notes. It is free for up to 50 people. Until it is set up, every request to NoteFlare is refused.

Create the login

1. In the Cloudflare dashboard, open Zero Trust.

   The first time, it asks you to pick a team name and the Free plan. Remember the team name: your team address is https://<team-name>.cloudflareaccess.com.

2. Go to Access → Applications → Add an application → Self-hosted.

   • Name: NoteFlare
   • Domain: your NoteFlare link, such as noteflare.<your-subdomain>.workers.dev, or your custom domain

   For a workers.dev link you can also turn Access on in Workers & Pages → noteflare → Settings → Domains & Routes.

3. Add a policy: Allow → Emails → your email address. Save the application.

   Login by emailed one-time code works right away. Google or GitHub login also work.

4. Open the application again and copy its Application Audience (AUD) Tag. It is a long string of letters and numbers.

Connect it to NoteFlare

1. On GitHub, open the noteflare repository that the deploy button created in your account.

2. Open wrangler.jsonc and click the pencil icon to edit it.

3. Fill in these lines with your team address and the AUD tag:

   wrangler.jsonc

   "vars": {
     "ACCESS_TEAM_DOMAIN": "https://<your-team>.cloudflareaccess.com",
     "ACCESS_AUD": "<AUD tag>",
     "ALLOWED_EMAILS": "you@example.com"
   }

4. Click Commit changes. Cloudflare redeploys by itself in a few minutes.

   If you deployed from the command line instead, edit the file on your computer and run bun run deploy.

5. Open your NoteFlare link. You should now see the Cloudflare login page, then NoteFlare.

Caution

The policy must name your email address, not “everyone”. Anyone the policy allows can reach the app, although they still cannot read notes without the passphrase.

Tips for phones

• An app added to the iPhone home screen keeps its own cookies, separate from Safari, so you sign in once inside the app.
• Access sessions last 24 hours by default. For a notes app you open every day, raise Session Duration on the Access application to a week or a month. When a session expires, NoteFlare keeps working on the device copy and shows Sign in to sync.
• If your browser doesn’t offer to install the app, or the home-screen icon is blank, the browser may be fetching the icons without your Access cookie. Add a second Access application for the paths /manifest.webmanifest and /icons/ with a Bypass policy. They contain only the app name and icons.

Next

Continue with Create your passphrase, then run through the hardening checklist.