is it possible to make calls from workers to tunnels without necessarily exposing the tunnels directly to the internet via a domain?
#is it possible to interface tunnels with workers?
willow silo
stable crow
Not really, the closest you can get is protecting the tunnel hostnames with Access and adding a Service Token as a secret to the Worker
willow silo
very interesting, i haven't worked with Access at all. can you give a quick summary of how that would be done? is there a library available to the workers that works with Access?
stable crow
You just create a Service Token: https://developers.cloudflare.com/cloudflare-one/identity/service-tokens/
And then add the ID and secret of the token to your Worker env/secrets and send all your requests with CF-Access-Client-Id and CF-Access-Client-Secret headers
Its not the most perfect security in the world (relies on a static secret) but its as good as you can get
willow silo
alright, i've figured out how to create a service token. and I think i can figure out how to set those headers. but how do i set a tunnel to be protected by the service token?
stable crow
As an aside, if you do this then make sure the tunnel Public Hostname as the "Protect with Access" option enabled has well as the Access policy existing https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/configure-tunnels/origin-configuration/#access-settings
willow silo
ah, i see it:
stable crow
alright, i've figured out how to create a service token. and I think i can figur...
Create a Self-hosted Access application covering the domain and create a policy with action "Service Auth"
You can then specify a certain service token in the "additional rules"
Or just yolo it and accept any:
willow silo
what about session duration?
stable crow
Its irrelevant for service auth policies
willow silo
perfect, going to the tunnel in my browser is blocked. that's expected. tomorrow i will try through the worker
many thanks 
stable crow
Yep if the only policy is Service Auth then you get the nice Forbidden page
willow silo
this is very convenient
stable crow
There is also a setting to redirect it to another page instead
Under "Non-identity failure block page" in the Access application settings
neat merlin
There is also a setting to redirect it to another page instead
Can’t you also just WAF block everything that isn’t your Worker?