Skip to main content
The simplest option, and the only one that also works in Superflow’s page previews. There is no sign in and no session. Your platform issues a secret intended for automation, Superflow sends it with each request, and the platform lets it through.
A bypass token works even when there is single sign on behind the platform gate, so check for one before setting up the longer single sign on option.

​
If you use Cloudflare Access

1

In the Cloudflare dashboard, go to Zero Trust → Access → Service auth

2

Create a service token

Give it a name you will recognise later, such as superflow-agent.
3

Copy the Client ID and the Client Secret

The secret is shown once, so copy it now.
4

Allow the token in the Access application that protects your site

Open the application, edit its policy, and add a rule that allows this service token. Without this rule the token exists but is not permitted anywhere.
5

Paste both values into Superflow

Open your project’s Site Access settings, choose Bypass token, and paste the Client ID and Client Secret.

​
If you use Vercel

1

In your Vercel project, go to Settings → Deployment Protection

2

Turn on Protection Bypass for Automation

Vercel generates a secret.
3

Copy that secret

4

Paste it into Superflow and leave the Client ID box empty

Choose Bypass token, paste the secret into the secret field, and leave the Client ID box empty. Leaving it empty is how you tell Superflow this is a Vercel token rather than a Cloudflare pair.

​
Why you are not asked to type a header name

Both platforms use fixed header names, and a correct secret pasted under a mistyped header name is the most likely way to configure this and have it silently do nothing. Superflow fills the names in for you so there is nothing to get wrong.

Related topics

When Something Is WrongLetting Superflow Read Your Protected SiteSingle Sign OnGenerating Auth TokensAgent Workflows