Cloudflare.OriginTlsClientAuth reference

Certificate

Source: src/Cloudflare/OriginTlsClientAuth/Certificate.ts

A zone-level Authenticated Origin Pulls (AOP) client certificate (/zones/{zone_id}/origin_tls_client_auth).

Uploads the client certificate Cloudflare presents to your origin when zone-level Authenticated Origin Pulls is enabled (Setting), letting the origin verify that requests really come from Cloudflare via mTLS.

Certificates are immutable: there is no update API, so changing any property triggers a replacement. Deployment is asynchronous — the certificate starts in pending_deployment and becomes active within a few minutes; deletion likewise passes through pending_deletion.

Certificate: Uploading a certificate

const cert = yield* Cloudflare.OriginTlsClientAuth.Certificate("AopCert", {
  zoneId: zone.zoneId,
  certificate: clientCertPem,
  privateKey: yield* Config.Redacted("AOP_CLIENT_KEY"),
});

Certificate: Enabling Authenticated Origin Pulls

const cert = yield* Cloudflare.OriginTlsClientAuth.Certificate("AopCert", {
  zoneId: zone.zoneId,
  certificate: clientCertPem,
  privateKey: yield* Config.Redacted("AOP_CLIENT_KEY"),
});

yield* Cloudflare.OriginTlsClientAuth.Setting("Aop", {
  zoneId: zone.zoneId,
  enabled: true,
});

HostnameAssociation

Source: src/Cloudflare/OriginTlsClientAuth/HostnameAssociation.ts

A per-hostname Authenticated Origin Pulls (AOP) association (/zones/{zone_id}/origin_tls_client_auth/hostnames).

Pins a hostname client certificate (HostnameCertificate) to a hostname and toggles hostname-level AOP for it. Cloudflare’s API is a bulk upsert keyed by hostname; this resource manages exactly one hostname per instance, so separate instances for different hostnames are safe to deploy concurrently. On destroy the association is voided (enabled: null), which restores the hostname to zone-level AOP behavior.

HostnameAssociation: Enabling AOP for a hostname

Associate a hostname with a client certificate

const cert = yield* Cloudflare.OriginTlsClientAuth.HostnameCertificate("AopHostCert", {
  zoneId: zone.zoneId,
  certificate: clientCertPem,
  privateKey: yield* Config.Redacted("AOP_CLIENT_KEY"),
});

yield* Cloudflare.OriginTlsClientAuth.HostnameAssociation("AopHost", {
  zoneId: zone.zoneId,
  hostname: "api.example.com",
  certId: cert.certificateId,
  enabled: true,
});

Keep the certificate pinned but disable enforcement

yield* Cloudflare.OriginTlsClientAuth.HostnameAssociation("AopHost", {
  zoneId: zone.zoneId,
  hostname: "api.example.com",
  certId: cert.certificateId,
  enabled: false,
});

HostnameCertificate

Source: src/Cloudflare/OriginTlsClientAuth/HostnameCertificate.ts

A per-hostname Authenticated Origin Pulls (AOP) client certificate (/zones/{zone_id}/origin_tls_client_auth/hostnames/certificates).

Uploads a client certificate that Cloudflare presents to your origin for specific hostnames. Hostnames opt in by referencing the certificate from an HostnameAssociation, which pins the certificate and enables hostname-level AOP.

Certificates are immutable: there is no update API, so changing any property triggers a replacement. Deployment is asynchronous — the certificate starts in pending_deployment and becomes active within a few minutes; deletion likewise passes through pending_deletion.

HostnameCertificate: Uploading a hostname certificate

const cert = yield* Cloudflare.OriginTlsClientAuth.HostnameCertificate("AopHostCert", {
  zoneId: zone.zoneId,
  certificate: clientCertPem,
  privateKey: yield* Config.Redacted("AOP_CLIENT_KEY"),
});

HostnameCertificate: Enabling AOP for a hostname

const cert = yield* Cloudflare.OriginTlsClientAuth.HostnameCertificate("AopHostCert", {
  zoneId: zone.zoneId,
  certificate: clientCertPem,
  privateKey: yield* Config.Redacted("AOP_CLIENT_KEY"),
});

yield* Cloudflare.OriginTlsClientAuth.HostnameAssociation("AopHost", {
  zoneId: zone.zoneId,
  hostname: "api.example.com",
  certId: cert.certificateId,
  enabled: true,
});

Setting

Source: src/Cloudflare/OriginTlsClientAuth/Setting.ts

The zone-level Authenticated Origin Pulls (AOP) toggle (/zones/{zone_id}/origin_tls_client_auth/settings).

The setting is a singleton — it always exists on every zone (Cloudflare default false), so this resource never creates or deletes anything physical. Reconcile flips the flag when the observed value differs from the desired one; destroy restores the value the setting had before Alchemy first managed it (captured as initialEnabled).

Enabling AOP only has effect once a zone client certificate is uploaded (Certificate) and your origin is configured to verify it — enabling the flag alone does not break traffic unless the origin enforces mTLS.

Setting: Enabling Authenticated Origin Pulls

Enable zone-level AOP

const cert = yield* Cloudflare.OriginTlsClientAuth.Certificate("AopCert", {
  zoneId: zone.zoneId,
  certificate: clientCertPem,
  privateKey: yield* Config.Redacted("AOP_CLIENT_KEY"),
});

yield* Cloudflare.OriginTlsClientAuth.Setting("Aop", {
  zoneId: zone.zoneId,
  enabled: true,
});

Pin AOP off

yield* Cloudflare.OriginTlsClientAuth.Setting("Aop", {
  zoneId: zone.zoneId,
  enabled: false,
});