Skip to content

Cloudflare Pages + MkDocs + Google Login (Zero Trust)

1. Repo prep

  1. Create requirements.txt at repo root containing: mkdocs mkdocs-material

  2. Ensure mkdocs.yml and /docs/ folder exist.

2. Deploy to Cloudflare Pages

  1. Cloudflare Dashboard → Pages → Create Project → connect GitHub repo.
  2. Build settings:
  3. Build command: bash pip install -r requirements.txt && mkdocs build --strict
  4. Output directory: site
  5. Environment variable: PYTHON_VERSION=3.11
  6. Add custom domain: skyll.docupreview.uk.

3. Enable Google login in Cloudflare Zero Trust

  1. Go to Zero Trust → Settings → Authentication → Login methods.
  2. Click Add new → Google.

4. Create OAuth credentials in Google Cloud

  1. Open Google Cloud Console.
  2. Create a new project.
  3. Go to APIs & Services → Credentials → Configure consent screen.
  4. Audience type: External
  5. Fill in required details → Save
  6. Create OAuth Client ID:
  7. Type: Web Application
  8. Authorized JavaScript origins: https://zytx.cloudflareaccess.com
  9. Authorized redirect URIs: https://zytx.cloudflareaccess.com/cdn-cgi/access/callback
  10. ⚠️ Use your Cloudflare Team Domain.
    In this setup the team name is zytx.
  11. Copy Client ID and Client Secret.

5. Add OAuth creds to Cloudflare

  1. In Cloudflare Zero Trust → Google login method.
  2. Paste:
  3. App ID = Google Client ID
  4. Client Secret = Google Client Secret
  5. Save.

6. Create Access Application

  1. Zero Trust → Access → Applications → Add application → Self-hosted
  2. Application name: Skyll Docs
  3. Domain: skyll.docupreview.uk
  4. Session duration: 24h
  5. Save.

7. Add Access Policy

  1. Inside the app → Policies → Add a policy.
  2. Policy name: Allowed users
  3. Action: Allow
  4. Include:
  5. Emails → alex@axiafutures.com
  6. Emails → friend@gmail.com
  7. (Optional) Emails ending in → axitradinggroup.com
  8. Save.

8. Test

  1. Open https://skyll.docupreview.uk in an incognito/private window.
  2. Login with an allowed email → access granted.
  3. Login with any other email → access denied.

9. (Optional) Protect Pages.dev previews

  1. Add another Access Application for <project>.pages.dev.
  2. Add pattern: *.<project>.pages.dev to also cover branch previews.
  3. Apply the same Allow policy.