Set up protected publishing

Publish Session Recorder reports to your own Cloudflare Pages project. Readers sign in through Cloudflare Access before they can open a report.

Create the report project#

1. Open Workers & Pages and create a dedicated Pages Direct Upload project. Upload an empty placeholder page for the initial deployment. Keep recorded reports out of that production deployment.
2. In the Pages project, open Settings → General → Enable access policy. This protects preview deployments. The production hostname and custom domains need separate rules if you use them. See Cloudflare’s preview Access guide.
3. Manage the generated application in Zero Trust → Access controls → Applications. Its hostname should be *.your-project.pages.dev, covering all paths. Use the actual Pages hostname, including any suffix Cloudflare assigned.
4. Add an Allow policy for your readers’ email addresses or configured identity provider. Email one-time PIN is also supported. Remove Bypass and Service Auth policies and public path overrides from this application.

For project creation details, see Cloudflare’s Direct Upload guide.

Connect the extension#

1. Open Settings → Publishing in Session Recorder. Copy your Cloudflare account ID from the dashboard into the account field.
2. Select Create a preconfigured API token. Review the requested permissions: Cloudflare Pages: Edit and Access: Apps and Policies: Read. Scope the token to your reporting account, choose an expiration, then create and copy it. Use an API token, not the Global API Key.
3. Enter the token and the Pages project name. From Zero Trust, copy the Access application ID (a UUID, not its audience/AUD tag) and your team domain, such as your-team.cloudflareaccess.com.
4. Select Verify Access & save. Session Recorder checks the configuration before publishing.

What readers see#

Each report gets its own preview deployment and permanent deployment URL. Readers sign in through your Access policy. The deployed report also checks Access tokens before serving any file, and fails closed.

Cloudflare account limits and billing apply. A GitHub issue’s summary follows the repository’s visibility; Access protects the linked report, not the issue text. See Protected report publishing for how reports are protected.

If verification or login fails#

• Permission error: check the token’s account scope, permissions and expiration.
• Application not found: use the application UUID rather than its audience tag.
• 403 or no login prompt: check the wildcard hostname, all-path coverage and team domain. Allow time for a new policy to propagate.
• A reader cannot sign in: confirm their email or identity provider is allowed. A Cloudflare dashboard login is separate from report login.

After you change the Access application or team domain, republish the report. To remove a published report, use Report options → Unpublish report or delete its deployment in Cloudflare. Deleting a local recording does not remove published copies.