Configurator — ZTNA Kit

Work top to bottom. Empty required fields show a warning and invalid values show an error, inline and in the summary. Nothing is sent anywhere.

Identifiers

Account ID Zone ID Zone name (your root domain)

Application

App name (also names the tunnel) App hostname Origin service (where cloudflared points) Session duration Extra hostnames (optional, one per line: host = service)

Identity

Allow email domains (comma separated) Identity provider Client ID Workspace domain Okta account URL Directory (tenant) ID

The client secret is never entered here. Terraform reads it from TF_VAR_idp_client_secret.

Gateway (DNS filtering)

Block security threats Command & Control, malware, botnets (Cloudflare threat intel) Block risky content categories questionable content, security risks, misc Custom domain blocklist Blocked domains (one per line)

Options

Also route a private network (CIDR) CIDR Paranoid ordering create Access protection before public DNS so the origin is never exposed Add a service token machine-to-machine access via a non-identity policy

State & repo

Terraform state R2 bucket State key Organization Workspace