![[]](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg){kind=link}
- Overview
- Get started
- Overview
- Replace your VPN
- Secure private apps
- Videos
- Insights
- Overview
- Analytics overview
- Network visibility
- Diagnostics
- Logs
- Overview
- Dashboard logs
- Logpush integration
- Team and resources
- Application Library
- Devices
- Overview
- Cloudflare One Client
- Device registration
- Networks
- Connectivity options
- Connectors
- Cloudflare Tunnel
- Overview
- Configure a tunnel
- Private networks
- Overview
- Connect with cloudflared
- Published applications
- Monitor tunnels
- Other tunnel types
- Overview
- Locally-managed tunnels
- Quick Tunnels
- Cloudflare WAN
- Overview
- WAN transformation
- Get started
- On-ramps
- Configuration
- Configure with Connector
- Overview
- Configure hardware Connector
- Configure Virtual Appliance
- Network options
- Device metrics
- Reference
- Troubleshooting
- Third-party integration
- Alibaba Cloud VPN Gateway
- Amazon AWS Transit Gateway
- Aruba EdgeConnect Enterprise
- Cisco IOS XE
- Cisco Meraki MX (static routing)
- Cisco SD-WAN
- Fortinet
- Furukawa Electric FITELnet
- Google Cloud VPN
- HPE Juniper Networking SRX Series Firewalls
- Microsoft Azure
- Oracle Cloud
- Palo Alto Networks NGFW
- pfSense
- SonicWall
- Sophos Firewall
- strongSwan
- Ubiquiti
- Velocloud
- VyOS
- Yamaha RTX Router
- Security filters
- Cloudflare One integration
- Network Interconnect (CNI)
- Load Balancing
- Public to private via Cloudflare WAN Beta
- Legal
- Granular permissions for Tunnels and Mesh nodes
- Resolvers and proxies
- Virtual networks
- Access controls
- Overview
- Applications
- Overview
- Choose an application type
- Add web applications
- Overview
- SaaS applications
- Overview
- Generic OIDC application
- Generic SAML application
- Adobe Acrobat Sign
- Area 1
- Asana
- Atlassian Cloud
- AWS
- Braintree
- Coupa
- Digicert
- DocuSign
- Dropbox
- GitHub Enterprise Cloud
- Google Cloud
- Google Workspace
- Grafana
- Grafana Cloud
- Greenhouse Recruiting
- Hubspot
- Ironclad
- Jamf Pro
- Miro
- PagerDuty
- Pingboard
- Salesforce (OIDC)
- Salesforce (SAML)
- ServiceNow (OIDC)
- ServiceNow (SAML)
- Slack
- Smartsheet
- SparkPost
- Tableau Cloud
- Workday
- Zendesk
- Zoom
- Self-hosted public application
- Managed OAuthBeta
- Authorization cookie
- Linked App Token
- Add bookmarks
- Service credentials
- Authenticate coding agents
- Event subscriptions
- Troubleshoot Access
- Traffic policies
- Cloud and SaaS findings
- Email security
- Overview
- Retro Scan
- Setup
- Before you begin
- Post-delivery deployment
- API deployment
- BCC/Journaling
- Pre-delivery deployment
- Manage domains
- Monitoring
- Investigation
- Settings
- Domain management
- Auto-move events
- Directories
- Overview
- Manage integrated directories
- Manage Email security directories
- PhishGuard
- Outbound Data Loss Prevention (DLP)
- Troubleshoot Email security
- Email security API API
- Data loss prevention
- Overview
- Data classification
- DLP settings
- Scan HTTP traffic
- Scan SaaS apps
- Scan AI Gateway traffic
- Troubleshoot DLP
- Reusable components
- Integrations
- Cloud and SaaS integrations
- Identity providers
- Overview
- Cloudflare as identity provider
- One-time PIN login
- Generic OIDC
- Generic SAML 2.0
- IdP federation
- Active Directory (SAML)
- Amazon Cognito
- AWS IAM (SAML)
- Centrify
- Centrify (SAML)
- Citrix ADC (SAML)
- GitHub
- Google Workspace
- JumpCloud (SAML)
- Keycloak (SAML)
- Microsoft Entra ID
- Okta
- Okta (SAML)
- OneLogin
- OneLogin (SAML)
- PingFederate
- PingOne
- PingOne (SAML)
- Signed AuthN requests (SAML)
- Yandex
- Roles and permissions
- Tutorials
- Reference architecture
- Account limits
- FAQ
- API and Terraform
- Glossary
- Home
- /Cloudflare One
- /Get started
- /Secure private apps
Secure private apps
Cloudflare Access lets users reach internal applications through a browser without a VPN or client software on their device. You connect your application to Cloudflare using a secure connection called a tunnel, then protect it with policies that control who can access it. For more background, refer to What is clientless access?.
How you set this up depends on the type of application you are securing. Choose the scenario that matches your use case:
Private web application
Connect an internal web application to Cloudflare and control who can access it. Best for applications like company intranets, internal wikis, or admin panels.
Clientless SSH
Provide in-browser command line access to an internal server without SSH client software on the user's device.
In-browser remote desktop
Provide in-browser remote desktop access to Windows hosts without remote desktop client software on the user's device.
Note
For in-depth guidance on clientless access and advanced configuration, refer to the Clientless access learning path.
On this page
[privacy options]Your privacy choices![[privacy options]](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=26,height=12,format=svg/_astro/privacyoptions.BWXSiJOZ.svg){kind=link}