Install the Cloudflare One client
The Cloudflare One client is also called WARP — the installer, the menu bar icon and the CLI all use that name, so don't be thrown by it. Download it from Cloudflare's official download page, or use your package manager below.
Download the macOS release from the download page and run the installer.
macOS will ask you to approve a system extension and a VPN configuration — both are expected. Approve them in System Settings when prompted, or the client cannot connect.
Download the Windows release from the download page and run the installer.
Installing needs local administrator rights. Reboot if the installer asks for one.
Cloudflare ships the Linux client through its own package repository. Follow Cloudflare's Linux install instructions for your distribution.
Linux is CLI-only — there is no GUI, so steps 02 to 04 use warp-cli.
Point it at the ai-fiesta team
A fresh install is consumer WARP and knows nothing about us. Enroll it into our Zero Trust organisation: open the client, go to Preferences → Account → Login with Cloudflare Zero Trust, and enter the team name exactly as below.
On Linux, or if you prefer the terminal anywhere:
warp-cli registration new ai-fiesta
# older builds: warp-cli teams-enroll ai-fiestaSign in with your aifiesta.ai Google account
The client opens ai-fiesta.cloudflareaccess.com in your browser. Choose Google, then pick your @aifiesta.ai account — the same one you use for Gmail and Drive at work.
Approve the Cloudflare consent screen if it appears, then return to the client when the page says you may close the tab. The device is now registered to you, and that identity is what every gated service checks.
Connect, then confirm you're actually on
Flip the toggle to Connected. Enrolled but disconnected is the single most common reason a gated page still shows the block screen — Access checks the live connection, not that you once logged in.
- The client reads Connected and the account shows the ai-fiesta team.
- one.one.one.one/help reports WARP: on.
- warp-cli status prints Status update: Connected.
Open a gated service
With the client connected, browse to any host in the table below and it should simply load — no second login page. Access reads your WARP session as the identity, so the gate is invisible when you're on the network and absolute when you're not.
Your session lasts 24 hours. After that the client re-authenticates you against Google, usually without asking anything.
What sits behind the gate
| Host | Service | Env |
|---|---|---|
| admin.meshapi.ai | MeshAPI internal admin SPA | prod |
| grafana.meshapi.ai | Grafana — dashboards and alerts | prod |
| metabase.meshapi.ai | Metabase — analytics and SQL | prod |
| admin-dev.meshapi.ai | Admin SPA | dev |
| dev-admin.meshapi.ai | Admin SPA (alias) | dev |
| blackpillow.meshapi.ai | Admin SPA (alias) | prod |
When it doesn't let you in
I get the Cloudflare block page
Almost always the client is installed but not connected, or it reconnected to consumer WARP instead of the team. Open the client: it must say Connected and show the ai-fiesta team under Account. If it shows neither, redo step 02.
It says my email isn't allowed
You signed in with a personal Gmail or another domain. Only @aifiesta.ai Workspace accounts may enroll. Sign out of the Zero Trust session in the client and sign in again with the right account.
It worked yesterday and stopped today
The session is 24 hours. Reconnecting normally re-authenticates you silently; if it doesn't, sign in again from the client's Account screen.
The client won't connect at all
Some hotel, café and corporate-guest networks block the WARP tunnel. Try a phone hotspot to confirm, then re-register the device:
warp-cli registration delete warp-cli registration new ai-fiesta warp-cli connect
Still stuck
Post in the team channel with your OS, what the client's Account screen shows, and the hostname you were trying to reach. Someone with Cloudflare Zero Trust admin can see your device and the Access decision log.