One Access

Appearance

Sessions & Staying Signed In ​

When you sign in interactively, Cloudflare Access issues a short-lived application token. This page explains what happens when it expires and how to keep a connection alive.

What expires ​

  • Application token — proves you're allowed to reach a specific host. Its lifetime is set by the Access application's session duration.
  • Global session — your single-sign-on identity across all Access apps. Set by the account's global session duration.

While your global session is valid, Access can hand out fresh application tokens. Once it lapses, you must authenticate with your identity provider again.

What One Access does on expiry ​

There is no silent background renewal. When the app token expires:

  1. New connections to that host are rejected; other hosts are independent.
  2. One Access posts a notification naming the host that needs sign-in.
  3. Tap it, or open the app and use that host's Sign In Again button.
  4. The new token is saved and applied to that host without restarting the VPN. Retry the failed client connection after completing login.

The same flow handles the first visit to a host with no cached token. Login requests for different hosts are queued, so browser sessions do not overwrite one another. Cancelling a login keeps the VPN available for other hosts.

An already-open SSH session keeps working; only new flows need a valid token.

Keeping a connection up longer ​

With interactive login you can stretch sessions in Zero Trust: set the global session duration longer than the application session duration, and use a real identity provider (not One-Time PIN). The longer global session then backs the shorter app tokens, so re-login is seamless while the global session lasts.

To avoid re-authenticating entirely you'd use a service token, which never expires — but note that's supported by the kernel and not yet available in the app.

Why not automatic renewal?

Silent renewal (org token → app token) only works when Access issues a reusable global-session token to the CLI. Many app/session configurations don't, so One Access relies on interactive re-login instead of pretending to renew.