What is One Access?

One Access is an iOS app that runs the client half of cloudflared access tcp directly on your phone, exposed as an on-device VPN. It lets you reach SSH — or any TCP service — behind a Cloudflare Access policy with no laptop, no cloudflared binary, and no exposed ports.

The problem it solves

Cloudflare Access fronts your internal services with an authenticated edge. Normally, to reach one from a device you run the cloudflared binary, which proxies a local port through an authenticated tunnel. That's fine on a laptop — but there's no cloudflared on iOS, and no easy way to point a phone's SSH client at an Access-protected host.

One Access puts that proxy inside the phone. It brings up a packet tunnel, dials the Access-fronted hostname over an authenticated WebSocket, and forwards TCP flows to the host selected by their virtual destination IP. Multiple hosts work concurrently; each has its own local name and IP. The VPN connects without logging in, and prompts only after an attempted visit needs authentication.

What you get

• On-device tunnel. No companion laptop, no port forwarding, nothing exposed to the internet.
• Access authentication. The app signs in with an interactive browser login, which yields a short-lived application token. Service tokens (Client ID + Secret) — a never-expiring, no-browser path — are supported by the kernel, with app support planned.
• .internal DNS. Connect to myhost.internal instead of a virtual IP — a built-in resolver answers those names inside the tunnel.
• Live stats. VPN uptime and cumulative download / upload totals.

Next steps

• Getting Started — add a host and connect.
• How It Works — the tunnel architecture under the hood.