Cloudflare Access login and block pages get full HTML templates
Admins can now build the login, denial and command-line approval screens with HTML and Liquid, pulling in the app name, signed-in user or a Ray ID instead of a generic default page.
Cloudflare added full HTML and Liquid templating for Cloudflare Access’s user-facing pages on 27 October: the login screen, identity-denied and forbidden pages, and the command-line approval screen. Templates are built and validated in the Cloudflare One dashboard, then assigned per application or set as an account-wide default.
The available Liquid variables differ by page. Login templates can reference app_name, app_domain, org and idps. Denial pages expose the signed-in user and an optional ray_id for support tickets, plus structured policy_evaluation data that Cloudflare says is deliberately “not a ready-made explanation”, so you choose what to surface without leaking group names or claims. Liquid output is HTML-escaped, and a missing variable just renders as empty text. Login and command-line pages each keep one required element outside any conditional, <cf-access-authbox></cf-access-authbox> or <cf-access-cli-approval></cf-access-cli-approval>.
{% if user.email %}
<p>You are signed in as {{ user.email }}.</p>
{% endif %}
{% if ray_id %}
<p>Share this Ray ID with your administrator: {{ ray_id }}</p>
{% endif %}Why it matters: if you run internal tools behind Cloudflare Access, your team has been staring at Cloudflare’s own branding and a generic denial page with no way to tell which rule blocked them. Templating that screen, and surfacing a Ray ID automatically, turns a dead end into something your support desk can actually diagnose.