Use Kinde as OpenID Connect provider for Cloudflare One (Zero Trust)

Cloudflare Zero Trust (Cloudflare One) protects internal applications and resources with access policies and federated sign-in. Instead of managing users in Cloudflare directly, you can connect an external identity provider and have users authenticate through your existing auth stack.

Kinde supports OpenID Connect (OIDC), so you can use it as the identity provider for Cloudflare Zero Trust. This guide walks you through the setup: configuring your Kinde application, adding the required callback URLs and OIDC endpoints, and registering Kinde in the Cloudflare Zero Trust dashboard.

What you need

Link to this section

• A Kinde account with Admin or Engineer permissions (sign up for free)
• A Cloudflare account (sign up for free)
• A backend web application set up in Kinde

Quickstart

Link to this section

1. Get your Cloudflare team domain

Link to this section

1. Sign in to Cloudflare and go to Zero Trust.

2. Go to Settings > Team domain and copy the team domain:

   <your_team_name>.cloudflareaccess.com

2. Get your Kinde app keys

Link to this section

1. In Kinde, go to Settings > Environment > Applications.

2. Select View details on the relevant backend web application.

3. Copy the Kinde domain (or custom domain), Client ID, and Client secret, and save them somewhere you can access later.

4. Scroll to the Callback URLs section and enter the following Zero Trust team callback URL in the Allowed callback URLs field. You can add multiple callback URLs, one per line.

   https://<your_team_name>.cloudflareaccess.com/cdn-cgi/access/callback

   Replace <your_team_name> with the name of your Cloudflare team

5. Select Save.

3. Get the OpenID endpoints

Link to this section

These are the OpenID endpoints for Kinde, found at:

<YOUR_DOMAIN>/.well-known/openid-configuration

Replace <YOUR_DOMAIN> with either your custom domain (e.g., https://auth.yourbusiness.com) or your Kinde domain (e.g., https://your_business.kinde.com)

Copy the following information somewhere you can access it later:

• JWKS URI: <YOUR_DOMAIN>/.well-known/jwks
• Authorization endpoint: <YOUR_DOMAIN>/oauth2/auth
• Token endpoint: <YOUR_DOMAIN>/oauth2/token
• Userinfo endpoint: <YOUR_DOMAIN>/oauth2/v2/user_profile
• Logout endpoint: <YOUR_DOMAIN>/logout

Other endpoints:

• Revocation endpoint: <YOUR_DOMAIN>/oauth2/revoke
• Introspection endpoint: <YOUR_DOMAIN>/oauth2/introspect

4. Add Kinde as a provider in Cloudflare

Link to this section

1. Back in the Cloudflare Zero Trust dashboard, go to Integrations > Identity providers.

2. Select Add an identity provider.

3. Select OpenID Connect as the identity provider.

4. On the new page that opens, enter the following details:

   • Name: Your connection identifier (e.g. “Kinde”)
   • App ID: Kinde Client ID
   • Client Secret: Kinde Client secret
   • Auth URL: The authorization endpoint (e.g. <YOUR_DOMAIN>/oauth2/auth)
   • Token URL: The token endpoint (e.g. <YOUR_DOMAIN>/oauth2/token)
   • Certificate URL: The JWKS URI (e.g. <YOUR_DOMAIN>/.well-known/jwks)

5. In the Optional configuration > OIDC claims section, configure the claims you want to receive from Kinde, such as name, given_name, family_name, and picture. See all available ID token claims on the ID token page.

   

6. Select Save.

5. Test the connection

Link to this section

1. After saving the connection, you are redirected to the Identity provider integrations page.

2. Select Test from the Kinde connection row.

3. A new tab opens with the Kinde login page. Complete the authentication process.

4. After successful authentication, you see the following page. If you enabled any OIDC claims, they appear on the page.

   

6. Enable Kinde as an identity provider for applications

Link to this section

1. In the Zero Trust dashboard, go to Access controls > Applications.
2. Select your application, or create one.
3. Select Login methods to open the Authentication section.
4. From the Choose available identity providers for this application dropdown, select Kinde (oidc).
5. Select Save.

You can now use Kinde as an OIDC provider to sign in to your Cloudflare Zero Trust applications.

Further reading

Link to this section

For access policies, protected applications, tunnels, and other Zero Trust features, see the Cloudflare One documentation. For OIDC identity provider configuration details, see Generic OIDC in the Cloudflare docs.