v0.21.0

0.21.0 (2026-10-08)

Features

• keep a sign-in with the provider's refresh tokens (#101) (7a88cdf)

v0.20.0

0.20.0 (2026-10-08)

Features

• keep the Worker's modules out of the plan (#99) (6a93b32)

v0.19.0

0.19.0 (2026-10-08)

⚠ BREAKING CHANGES

• the Terraform module no longer warns when the broker isn't ready. Add tf-contrib/terraform-http-check with url = "${module..url}/health/ready" to keep the warning.

Features

• leave the readiness check to terraform-http-check (#97) (90ac7ce)

v0.18.0

0.18.0 (2026-10-08)

⚠ BREAKING CHANGES

• deployment/terraform/modules/access is gone. Use tofu-contrib/terraform-cloudflare-access//modules/saas-oidc with name = "cloudflare-sts" and redirect_uris = ["http://127.0.0.1:8250/callback"], its old defaults, and build the provider from its issuer and client_id outputs.
• nothing takes the old names. The Worker's bindings are CLOUDFLARE_STS_API_* (were CF_STS_API_), and the CLI reads CLOUDFLARE_STS_CLI_ (was CF_STS_CLI_*). Minted tokens are named cloudflare-sts:…, and revoke and the hourly cleanup no longer touch cf-sts:… tokens. The R2 token type is urn:cloudflare-sts:params:oauth:token-type:r2_credentials. The Terraform module's worker_name defaults to cloudflare-sts-api: set worker_name = "cf-sts" to keep an existing Worker and its workers.dev URL, the OIDC audience. The Access module's name defaults to cloudflare-sts.

Features

• rename the project cloudflare-sts (#92) (6fed0fc)
• sign people in with terraform-cloudflare-access (#95) (8e08455)

v0.17.0

0.17.0 (2026-10-07)

Features

• keep an Access sign-in for 8h (#90) (4471b5b), closes #53

v0.16.0

0.16.0 (2026-10-07)

Features

• an Access module, for signing people in (#88) (daff6c5), closes #53
• ready only while the config checks out (#87) (67ce5bb)

v0.15.0

0.15.0 (2026-10-07)

Features

• the cf-sts CLI, for people (#85) (cb2a4c7)

v0.14.0

0.14.0 (2026-10-07)

⚠ BREAKING CHANGES

• nothing takes the old names. The Worker's bindings are CF_STS_API_* (were CF_OIDC_EXCHANGE_API_*). Minted tokens are named cf-sts:…, and revoke and the hourly cleanup no longer touch cf-oidc:… tokens. The R2 token type is urn:cf-sts:params:oauth:token-type:r2_credentials. The Terraform module's worker_name defaults to cf-sts: set worker_name = "cf-oidc-exchange" to keep an existing Worker and its workers.dev URL, the OIDC audience.

Code Refactoring

• rename the project cf-sts (#82) (147a690)

v0.13.0

0.13.0 (2026-10-06)

Features

• allow : and / in profile names (d855533), closes #78

v0.12.0

0.12.0 (2026-10-05)

⚠ BREAKING CHANGES

• the action no longer exports AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, AWS_SECURITY_TOKEN, AWS_ENDPOINT_URL_S3, AWS_REGION or AWS_DEFAULT_REGION. A step that runs S3 tools sets them from CLOUDFLARE_R2_* itself.

Features

• export R2 credentials as CLOUDFLARE_R2_, not AWS_ (a9cdd33), closes #74