Admin & Employee Logins
Set up the first founder login, then add employees without sharing passwords or bypassing Cloudflare Access.
team_members table decides what that person can do.First founder / Super Admin
Create or choose the company identity
Use an individual company email. Enable MFA at the identity provider.
Add the identity to the Command Access policy
Cloudflare Access must allow that exact identity to reach the protected Command hostname.
Set BOOTSTRAP_ADMIN_EMAIL
Set it in the Command Pages environment to the exact lowercase/real email returned by Access. Redeploy after changing environment variables.
Sign in once
Visit the protected Command URL. Command creates that bootstrap identity as super_admin only when the email matches and no team record exists yet.
Verify
Open Team & Access. Your account should appear. Also check /setup-doctor.html.
Add an employee/admin later
Create their own identity
No shared founder/admin password.
Allow them through Access
Add the email or approved group to the Access policy.
Add them inside Command
Command → Team & Access → Add / Update Employee. Use the exact same email and choose Viewer, Legal Reviewer, Editor, Technical Admin, or Super Admin.
Test in an incognito/private window
Confirm the user can log in and cannot access tools beyond their role.
BOOTSTRAP_ADMIN_EMAIL.Production authentication verification
Create the Cloudflare Access application
Protect the entire Command hostname, not just the homepage.
Copy the Access team domain and application AUD
Set CF_ACCESS_TEAM_DOMAIN and CF_ACCESS_AUD in the Command environment.
Require JWT validation
Set COMMAND_REQUIRE_ACCESS_JWT=true, redeploy, then sign in again.
Verify with Setup Doctor
Access JWT verification must be a green CORE check before production use.
COMMAND_ALLOW_HEADER_AUTH=true as a production shortcut. Every employee should have an individual identity in the identity provider, an Access policy decision, and a Command role record.