Skip to content
SoundLeaf
App Store
Menu

Guides · Advanced

Use Audiobookshelf behind Cloudflare Access on iPhone

Cloudflare Access blocks apps with its email code sign-in. Make a service token, add a Service Auth policy, then add two headers in SoundLeaf.

Updated

All guides

Getting started

Features

Advanced

Troubleshooting

On this page
  1. Why can’t the app open a browser to sign in?
  2. Step 1: Create a service token
  3. Step 2: Add a Service Auth policy
  4. Step 3: Add the headers in SoundLeaf
  5. Troubleshooting
  6. ”The address did not return an Audiobookshelf status response”
  7. ”The server denied access (401)” or “Access was denied (403)”
  8. Sign-in works but covers or playback don’t
  9. Works in Safari but not in the app
  10. More help

If Cloudflare Access sits in front of your Audiobookshelf server, apps can’t get past it on their own. The workaround is a Cloudflare service token, which SoundLeaf sends as two headers (extra values sent with every request to your server).

Make the token, add a Service Auth policy, then add the two headers in SoundLeaf.

Why can’t the app open a browser to sign in?

Cloudflare Access puts its own sign-in page in front of your server. In a browser you get an email code (a one-time PIN, or OTP), or a Google or GitHub login. An app asks the server for data directly, so there’s no page to show you, and Cloudflare blocks it.

A service token gets around that. It’s a Client ID and a Client Secret that Cloudflare accepts instead of the email code. You still sign in to Audiobookshelf afterward, with your username and password or with OpenID.

If you use a Cloudflare Tunnel with no Access sign-in page in front of it, you don’t need any of this.

Step 1: Create a service token

  1. Open the Cloudflare Zero Trust dashboard.
  2. Go to Access controls > Service credentials > Service Tokens.
  3. Select Create Service Token.
  4. Give it a name, such as “SoundLeaf”, and pick how long it should last.
  5. Select Generate token and copy both values:
    • CF-Access-Client-Id
    • CF-Access-Client-Secret

The secret is shown only once. Save it somewhere safe. If you lose it, make a new token.

Step 2: Add a Service Auth policy

The token only works if your Access application has a policy whose action is Service Auth. An Allow policy on its own won’t let the token in.

  1. Open your Audiobookshelf application in Access.
  2. Add a policy to it.
  3. Set the Action to Service Auth.
  4. Under Include, choose Service Token and pick the token you made.
  5. Save the policy.

Make sure the application covers your whole Audiobookshelf address, not only some paths. The app needs every path, including covers and audio.

Step 3: Add the headers in SoundLeaf

On the sign-in screen, before you sign in:

  1. Tap Connection settings.
  2. Tap Add Header.
  3. In Header name, type CF-Access-Client-Id. In Header value, paste your Client ID.
  4. Tap Add Header again. Type CF-Access-Client-Secret and paste your Client Secret.
  5. Check Use this header is on for both.
  6. Go back, type your server address, then sign in with your Audiobookshelf username and password (tap Sign In) or your server’s OpenID button.

Already signed in? The same headers live in Settings > Servers > (your server) > Server Details, in the Headers section. Tap Add Header there.

SoundLeaf sends these headers with every request to that server, including covers, streaming and downloads. Every account you save on that server uses them.

Troubleshooting

”The address did not return an Audiobookshelf status response”

Something other than Audiobookshelf answered. Behind Cloudflare Access, that’s usually Cloudflare’s sign-in page, because the headers are missing, switched off or not accepted. Check your server address, then the steps below.

”The server denied access (401)” or “Access was denied (403)”

Cloudflare or your server refused the request. Check the token and the policy first:

  • Check the Client ID and Secret for typos and extra spaces.
  • Check the header names are exactly CF-Access-Client-Id and CF-Access-Client-Secret.
  • Check the policy action is Service Auth, not Allow.
  • Check the token hasn’t expired in the Cloudflare dashboard.

Sign-in works but covers or playback don’t

Check whether a different Access policy applies to the cover or audio paths. The service token policy needs to cover the whole address. If that’s fine, see connection troubleshooting.

Works in Safari but not in the app

Safari keeps your Cloudflare sign-in as a cookie. The app can’t use that, so it needs the service token. If the token is set and it still fails, see connection troubleshooting.

More help