Android app directory · VPN and access
These are the managed configuration parameters Cloudflare documents for the Cloudflare One Agent on Android, which Cloudflare says replaced the legacy 1.1.1.1 app. They cover enrolling the device in your Zero Trust organization, how the client behaves and which apps go through it. Cloudflare publishes one parameter list for several platforms and marks platform limits on some of them, such as use_in_app_webview and unique_client_id, which are valid for Android. Check Cloudflare's page for the platform and client version of any other parameter before you rely on it.
Nomidcom.cloudflare.cloudflareoneagent Common setups
Copy a setup into the managed configuration of a policy, then adjust the values. Each one uses only keys explained below.
Register the device in your organization, skip the intro screens and stop people switching the client off. Cloudflare requires auto_connect with this lock on new deployments, so the client starts connected.
{
"organization": "example-team",
"onboarding": false,
"switch_locked": true,
"auto_connect": 0
}Use Gateway DNS filtering on a chosen location without tunnelling traffic, and give people a support address.
{
"organization": "example-team",
"service_mode": "1dot1",
"gateway_unique_id": "abcd1234",
"support_url": "mailto:it@example.com"
}If someone turns the client off, it comes back on after ten minutes. Sign-in happens in the in-app web view.
{
"organization": "example-team",
"auto_connect": 10,
"use_in_app_webview": true
}Managed configuration
Key names and value types come from the vendor’s documentation. The explanations are written by Nomid.
| Key | Type | What it does | Example |
|---|---|---|---|
| Enrolment | |||
organization | Zero Trust team name | Registers the device with your organization. People then sign in through your identity provider. | example-team |
auth_client_id | Service token client ID | Enrols the device with a service token so nobody has to sign in. It works together with auth_client_secret. | abc123.access |
auth_client_secret | Service token secret | The secret that goes with the service token client ID. Treat it like a password, since it sits in your MDM policy. | |
display_name | Organization nickname | The organization name shown in the app. Cloudflare requires it when you list more than one organization. | Example Ltd |
onboarding | On or off | Shows or hides the privacy policy screens people see when they first open the app. Turn it off for a quiet rollout. | false |
use_in_app_webview | On or off | Uses a built-in web view for sign-in instead of the system browser. Documented for Android and ChromeOS. | false |
| Behavior and mode | |||
service_mode | Choice: warp, 1dot1, proxy, postureonly, tunnelonly | Sets how the client works, from full tunnelling to posture checks only. The proxy option also reads proxy_port. | warp |
switch_locked | On or off | Stops people from turning the client off. Use it when protection must stay on at all times. On new deployments, also set auto_connect to 0 or higher, so the client does not start switched off with no way to turn it on. | true |
auto_connect | Minutes, 0 to 1440 | If someone switches the client off, it turns itself back on after this many minutes. Zero leaves it off until they turn it on. | 15 |
gateway_unique_id | DNS location subdomain | Sends DNS queries to a specific Gateway DNS location so the right filtering policy applies. | abcd1234 |
support_url | https or mailto link | Turns the feedback button back on and points it to your own help page or mailbox. | mailto:it@example.com |
unique_client_id | Device UUID | A unique identifier for the device that the UUID posture check in Zero Trust can match against. Android and ChromeOS only. | 6f9619ff-8b86-d011-b42d-00cf4fc964ff |
| Per-app tunnel | |||
app_identifier | Package name | Names an Android app whose traffic should go through the client. Add one entry for each app you want tunnelled. | com.example.erp |
is_browser | On or off | Marks a per-app entry as a browser so the client can ask for re-authentication and show block notices there. | true |
Deploy with Nomid
Find it on Google Play from the policy’s apps list and choose how it is installed.
In the policy, set the app’s managed configuration with the keys and values from this page.
Devices in the policy receive Cloudflare One Agent and its configuration on their next sync.
Questions
com.cloudflare.cloudflareoneagent. Cloudflare's download page links the legacy 1.1.1.1 app under com.cloudflare.onedotonedotonedotone and says the Cloudflare One Agent has replaced it.
Cloudflare's download page says the legacy Android client has been replaced by the Cloudflare One Agent and points to a migration guide. This page does not cover that guide.
Yes, with auth_client_id and auth_client_secret from a service token. Keep in mind the secret is stored in your MDM policy.
No. Some are for Windows or macOS only. Check Cloudflare's parameter page for the platform column before you rely on one.
Add the app to a Nomid policy, set its configuration and choose its permissions.
