Cloudflare OAuth for Allegro Edge

Allegro Edge deploys a worker into each organization's own Cloudflare account. Organizations grant that access from Organization Settings → Allegro Edge. With a platform OAuth client configured, they click Connect Cloudflare and approve Allegro on Cloudflare's consent screen. Without one, the page only offers the API token fallback, where an admin creates a token in Cloudflare and pastes it in.

You register one OAuth client for the whole Allegro instance. Every organization authorizes that same client.

Environment Variables

Variable	Required	Description
EDGE_CLOUDFLARE_CLIENT_ID	Yes	The client ID Cloudflare shows after you create the client.
EDGE_CLOUDFLARE_CLIENT_SECRET	Yes	The client secret. Cloudflare shows it once, so copy it when the client is created.
EDGE_CLOUDFLARE_AUTHORIZE_URL	No	Consent URL. Defaults to https://dash.cloudflare.com/oauth2/auth.
EDGE_CLOUDFLARE_TOKEN_URL	No	Token URL. Defaults to https://dash.cloudflare.com/oauth2/token.
EDGE_CLOUDFLARE_REVOKE_URL	No	Revocation URL. Defaults to https://dash.cloudflare.com/oauth2/revoke.
EDGE_CLOUDFLARE_SCOPE_ACCOUNT	No	Scope for reading accounts. Defaults to account-settings.read.
EDGE_CLOUDFLARE_SCOPE_ZONES	No	Scope for reading zones. Defaults to zone.read.
EDGE_CLOUDFLARE_SCOPE_SCRIPTS	No	Scope for editing Workers scripts. Defaults to workers-scripts.edit.
EDGE_CLOUDFLARE_SCOPE_ROUTES	No	Scope for editing Workers routes. Defaults to workers-routes.write.
EDGE_CLOUDFLARE_SCOPE_REFRESH	No	Scope that issues a refresh token. Defaults to offline_access.

When EDGE_CLOUDFLARE_CLIENT_ID or EDGE_CLOUDFLARE_CLIENT_SECRET is missing, Connect Cloudflare is hidden and organizations can only connect with an API token.

Redirect URL

Cloudflare redirects every organization back to one URL on your instance's main domain, not the organization's own subdomain:

https://your-allegro-instance.com/edge/oauth/callback

The domain is your APP_URL. Allegro reads the organization from the signed state parameter, forwards the request to that organization's settings page, and finishes the connection there under the signed-in admin's session.

Creating the OAuth Client

1. Log in to the Cloudflare dashboard and select the account that owns the Allegro instance.
2. Go to Manage Account → OAuth clients and click Create client.
3. Fill in the client details:
   • Client name: the name organizations see on the consent screen, such as Allegro Edge.
   • Response type: code.
   • Grant type: Authorization Code, with Refresh Token.
   • Token authentication method: client_secret_basic.
   • Redirect URLs: https://your-allegro-instance.com/edge/oauth/callback.
4. Click Continue and add the scopes below. Leave all of them required.
5. Click Create client, then copy the client ID and client secret into the environment variables above.

Dashboard scope	Scope ID	Why Allegro needs it
Account Settings: Read	account-settings.read	Lists the accounts the grant covers so an admin can pick one.
Zone: Read	zone.read	Matches each property's hostname to a zone.
Workers: Edit	workers-scripts.edit	Uploads and updates each property's edge worker.
Workers Routes: Edit	workers-routes.write	Binds each worker to its property's hostname.

Allegro also requests offline_access so Cloudflare issues a refresh token and deploys keep working after the access token expires. It is not one of the dashboard checkboxes; the Refresh Token grant type covers it.

Check the scope names

Cloudflare lists the exact scope IDs at GET https://api.cloudflare.com/client/v4/oauth/scopes. If they differ from the defaults above, set the EDGE_CLOUDFLARE_SCOPE_* variables to match. Allegro requests exactly those IDs and checks the granted scopes against them.

Making the Client Public

New clients are private. A private client can only be authorized by members of the Cloudflare account that created it, which is enough for testing against your own zones.

Before other organizations can connect, make the client public:

1. Verify ownership of the client's domain, as described in Cloudflare's client domain verification guide.
2. Fill in the fields Cloudflare requires for public clients, such as the logo, privacy policy, and terms of service URLs.
3. In OAuth clients, open the client's action menu and choose Change Visibility.

Public is permanent

Cloudflare cannot switch a public client back to private. Finalize the client name, logo, and scopes before you make it public.

Connection Lifetime

An OAuth grant belongs to the Cloudflare user who approved it. If that person leaves the organization's Cloudflare account or loses access to it, Cloudflare stops honoring the grant. The Allegro Edge settings page then shows Needs reconnect, and deploys stop until someone connects again.

The settings page shows who connected the account and when, so you can trace a broken connection to a person. Organizations that want a connection that doesn't depend on one person can use an account-owned API token instead.

API Token Fallback

The API token option stays available whether or not OAuth is configured. Create token in Cloudflare opens Cloudflare's token form with the needed permissions selected. The admin creates the token and pastes it into Allegro.

API tokens don't report their permissions. Allegro checks read access to Workers scripts and routes, and marks edit access as unverified until the first deploy tries it.