> ## Documentation Index
> Fetch the complete documentation index at: https://docs-staging-quickstart-revamp.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> Learn how to set up Cloudflare for use as the custom domain proxy for Auth0.

# Configure Cloudflare as Reverse Proxy

<Card title="Availability varies by Auth0 plan">
  Your Auth0 plan or custom agreement affects the availability of this feature. To learn more, read [Auth0's Pricing Page](https://auth0.com/pricing).
</Card>

To set up Cloudflare as a reverse proxy using the recommended approach, a Cloudflare Enterprise Plan with the following features is required:

<table class="table">
  <thead>
    <tr>
      <th><strong>Feature</strong></th>
      <th><strong>Description</strong></th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Host Header Override</td>
      <td>Rewrite Host headers using different Cloudflare rules. To learn more, read <a href="https://support.cloudflare.com/hc/en-us/articles/206652947-Using-Page-Rules-to-Re-Write-Host-Headers">Rewrite Host headers on Cloudflare Docs</a>.</td>
    </tr>

    <tr>
      <td>True-Client-IP Header</td>
      <td>Enabling the True-Client-IP Header adds the True-Client-IP header to all requests to your origin server, which includes the end user’s IP address. To learn more, read <a href="https://support.cloudflare.com/hc/en-us/articles/206776727-What-is-True-Client-IP-">Understanding the True-Client-IP Header on Cloudflare Docs</a>.</td>
    </tr>
  </tbody>
</table>

## Configure Cloudflare

<Warning>
  As a prerequisite, the parent domain for your chosen custom domain must be [added and activated within the Cloudflare dashboard](https://developers.cloudflare.com/learning-paths/get-started/add-domain-to-cf/minimize-downtime/#activate-your-domain). Also, confirm that your desired custom domain does not already exist within your Cloudflare zone. If it already exists, Cloudflare verification will fail.
</Warning>

To configure Cloudflare as a reverse proxy, you’ll need to create a CNAME record, a Page Rule, and a Transform Rule in Cloudflare.

1. [Configure and verify a Custom Domain with Self-Managed Certificates](/docs/customize/custom-domains/self-managed-certificates) if you haven't already. Make note of the **Origin Domain Name** and **cname-api-key** values since you'll need these later.
2. In the Cloudflare dashboard for the target zone, [create a CNAME record](https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/#create-dns-records) with the following settings:

   <table class="table">
     <thead>
       <tr>
         <th><strong>Setting</strong></th>
         <th><strong>Value</strong></th>
       </tr>
     </thead>

     <tbody>
       <tr>
         <td>Name</td>
         <td>The custom domain name.</td>
       </tr>

       <tr>
         <td>Target</td>
         <td>The <strong>Origin Domain Name</strong> value recorded earlier.</td>
       </tr>

       <tr>
         <td>Proxy Status</td>
         <td><code>Proxied</code></td>
       </tr>
     </tbody>
   </table>
3. [Create a Page Rule](https://support.cloudflare.com/hc/en-us/articles/200172336-Creating-Page-Rules) scoped to all URLs under the chosen custom domain and with the following settings:

   <table class="table">
     <thead>
       <tr>
         <th><strong>Setting</strong></th>
         <th><strong>Value</strong></th>
       </tr>
     </thead>

     <tbody>
       <tr>
         <td>Host Header Override</td>
         <td>The <strong>Origin Domain Name</strong> value recorded earlier.</td>
       </tr>

       <tr>
         <td>True-Client-IP</td>
         <td><code>Enable</code></td>
       </tr>
     </tbody>
   </table>
4. [Create a Transform Rule](https://developers.cloudflare.com/rules/transform/request-header-modification/create-dashboard/):

   1. Switch to the **Modify Request Header** view.
   2. Select **Create Rule** and provide a name of your choice.
   3. Under **When incoming requests match**, select **Custom filter expression** and set an expression that scopes the Rule to requests associated with the chosen custom domain. For example, use an exact match on the **Hostname** field.
   4. Under Modify request header, select **Set static**, and then set the following fields:

      <table class="table">
        <thead>
          <tr>
            <th><strong>Field</strong></th>
            <th><strong>Value</strong></th>
          </tr>
        </thead>

        <tbody>
          <tr>
            <td>Header name</td>
            <td><code>cname-api-key</code></td>
          </tr>

          <tr>
            <td>Value</td>
            <td>The <strong>cname-api-key</strong> value recorded earlier.</td>
          </tr>
        </tbody>
      </table>
5. Ensure that [Always Use HTTPS](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/always-use-https/) is enabled and [encryption mode](https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/) is set, at least, to **Full** for your chosen custom domain.

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  While it is possible to use Cloudflare Workers instead of Page and Transform rules to set up a reverse proxy that meets the requirements for a self-managed certificate custom domain, we recommend using the rules-based approach because it eliminates the need for custom code.
</Callout>

## Configure Auth0

Call the Auth0 <Tooltip tip="Management API: A product to allow customers to perform administrative tasks." cta="View Glossary" href="/docs/glossary?term=Management+API">Management API</Tooltip> [Update custom domain configuration](https://auth0.com/docs/api/management/v2#!/Custom_Domains/patch_custom_domains_by_id) endpoint with the following payload in the body:

```json lines
{
  "custom_client_ip_header": "true-client-ip"
}
```

## Learn more

* [Configure Features to Use Custom Domains](/docs/customize/custom-domains/configure-features-to-use-custom-domains)
* [Troubleshoot Custom Domains](/docs/troubleshoot/integration-extensibility-issues/troubleshoot-custom-domains)
* [TLS (SSL) Versions and Ciphers](/docs/customize/custom-domains/self-managed-certificates/tls-ssl)