Cloudflare Zero Trust Identity Verification

How the integration works

Turn Verified Identity Into Enforced Access

Cloudflare Zero Trust controls who can reach protected applications and under what conditions. HYPR Affirm adds a critical layer of assurance: confidence that the person requesting access is the legitimate human behind the enterprise account.

Through a standards-based OpenID Connect integration, HYPR Affirm becomes part of the Cloudflare-protected access flow. When a privileged application requires step-up identity verification, the user completes the appropriate Affirm workflow. HYPR associates the verified person with their enterprise identity and returns a signed identity assertion. Cloudflare then evaluates its Zero Trust policies and makes the final access decision.

Together, HYPR and Cloudflare connect high-assurance identity verification with real-time access enforcement, helping organizations protect sensitive resources without replacing their existing directories, applications, or access architecture.

HYPR Affirm

Is this the legitimate person?

Configurable identity-verification workflows
Document, biometric, and liveness checks
Directory-based identity association
Risk-informed escalation and approval

Cloudflare Zero Trust

Should this person receive access now?

Application-level access policy
User and group requirements
Device posture and contextual controls
Session and access enforcement

The result

High-Assurance Access

A verified person. The right conditions. An enforced decision.

Apply step-up verification to privileged resources
Match verification strength to application sensitivity
Add identity assurance without reworking protected applications
Keep identity verification and access enforcement clearly separated

Workflow in action

See step by step how HYPR Affirm works with Cloudflare Zero Trust

Follow an access request from the protected application through identity verification and Cloudflare policy enforcement. Each step shows who is acting — the end user, HYPR, or Cloudflare.

End user
HYPR
Cloudflare

JavaScript is disabled, so this section shows only the first step, App request. Enable JavaScript to step through all six parts of the workflow.

End user

admin.acme.com

🔒 Protected by Cloudflare Access

Production Administration

Manage production systems and deployment settings.

Illustrative interface. Not an actual customer environment.

Step 1 — End user: Application request. The user attempts to open an application protected by Cloudflare Access. The application could be an administrative console, financial system, internal tool, or other sensitive resource.

Step 1 of 6: App request — End user

Identity lifecycle

Extend Identity Assurance Beyond Application Access

The Cloudflare integration brings HYPR verification to the application access boundary. HYPR Affirm also supports identity workflows across the wider employee lifecycle.

JavaScript is disabled, so this section shows only the first use case, Remote Onboarding. Enable JavaScript to see all four.