Beta access

Invitation

An administrator creates a single-use link bound to an email and role. Links expire after seven days and cannot be reused after acceptance or revocation.

Passkey enrollment

1. Open the complete invitation URL on the device you want to enroll.
2. Create a passkey using Windows Hello, a security key, or another supported authenticator.
3. Save all one-time recovery codes outside the browser.
4. Continue to Downloads or Administration after enrollment.

Sessions

Sessions use secure, HttpOnly, same-site cookies, expire after 12 hours, and can be revoked. The server stores a peppered token hash rather than the presented session secret.

Artifact downloads

Published artifacts remain private in R2. The Worker verifies your session and channel access, streams the object, returns its SHA-256 header, disables shared caching, and writes an audit event.

Request and approval flow

1. Submit your name, email, and useful testing context on the public beta page.
2. An authorized administrator reviews the request.
3. Approval creates a seven-day, single-use enrollment link and sends it through Cloudflare Email Service.
4. Open the link once and enroll a passkey.
5. Use that passkey for later sign-ins and authorized installer downloads.

Invitation versus credential

Recovery