PHP Service-Token Gate

Block a page behind the service token secret

Drop this PHP script at the top of any PHP page on your server. Visitors must enter the Cloudflare Access service token secret; until they do, the page returns a 403 gate and never loads.

gate.php

Self-contained — paste your client secret into the config line.

<?php
session_start();

// Replace with your Cloudflare Access service token client secret.
$EXPECTED_SECRET = 'PASTE_YOUR_CF_ACCESS_CLIENT_SECRET';

// End the session when ?logout is visited.
if (isset($_GET['logout'])) {
    session_destroy();
    header('Location: ' . strtok($_SERVER['REQUEST_URI'], '?'));
    exit;
}

// Validate the submitted secret.
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $secret = trim($_POST['secret'] ?? '');
    if (hash_equals($EXPECTED_SECRET, $secret)) {
        $_SESSION['token_authorized'] = true;
        header('Location: ' . strtok($_SERVER['REQUEST_URI'], '?'));
        exit;
    }
    $error = 'Invalid service token secret.';
}

// Block the page unless the secret has been entered.
if (empty($_SESSION['token_authorized'])) {
    http_response_code(403);
    ?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Service Token Required</title>
<style>
  body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#020617;color:#e2e8f0;font-family:system-ui,-apple-system,sans-serif}
  .card{width:100%;max-width:380px;margin:1rem;padding:2rem;background:#0f172a;border:1px solid #1e293b;border-radius:14px;box-shadow:0 20px 50px rgba(0,0,0,.5)}
  h1{font-size:1.15rem;margin:0 0 .5rem}
  p{color:#94a3b8;font-size:.875rem;margin:0 0 1.25rem}
  input{width:100%;box-sizing:border-box;padding:.65rem .75rem;background:#020617;border:1px solid #334155;color:#e2e8f0;border-radius:8px;font-size:.9rem}
  input:focus{outline:none;border-color:#3b82f6}
  button{width:100%;margin-top:.85rem;padding:.65rem;background:linear-gradient(90deg,#3b82f6,#22d3ee);color:#fff;border:0;border-radius:8px;font-weight:600;cursor:pointer}
  .err{color:#fb7185;font-size:.8rem;margin-top:.5rem}
</style>
</head>
<body>
  <div class="card">
    <h1>Service Token Required</h1>
    <p>Enter your Cloudflare Access service token secret to continue.</p>
    <form method="post">
      <input type="password" name="secret" placeholder="Client Secret" autofocus>
      <?php if (!empty($error)): ?><div class="err"><?= htmlspecialchars($error) ?></div><?php endif; ?>
      <button type="submit">Unlock</button>
    </form>
  </div>
</body>
</html>
    <?php
    exit;
}

// ===== Protected page content below — replace with your real page =====
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Protected Page</title>
<style>
  body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#020617;color:#e2e8f0;font-family:system-ui,-apple-system,sans-serif}
  .card{padding:2.5rem;background:#0f172a;border:1px solid #1e293b;border-radius:14px;text-align:center}
  h1{margin:0 0 .5rem} p{color:#94a3b8;margin:0 0 1.25rem}
  a{color:#38bdf8;text-decoration:none;font-size:.85rem}
</style>
</head>
<body>
  <div class="card">
    <h1>Welcome</h1>
    <p>You are viewing protected content.</p>
    <a href="?logout">End session</a>
  </div>
</body>
</html>

1. Set $EXPECTED_SECRET to your Cloudflare Access client secret.

2. Include the file at the top of the page you want to protect: <?php require 'gate.php'; ?>

3. Replace the protected content block with your real page. Visit ?logout to end a session.