Operate an Access-mode installation

Identify the modeCopy Anchor Link

Customer installations use managed Sparta accounts. Existing source-managed deployments can retain Cloudflare Access mode.

Check the deployed authentication mode on both the web and API Workers. Do not mix modes.

Plan a managed-account migrationCopy Anchor Link

1. Apply the managed-account migrations and retain tested backups.
2. Configure managed mode on both Workers and the exact HTTPS application origin.
3. Preserve encryption keys and configure the protected first-admin setup token.
4. Deploy the private API before the web Worker.
5. After the managed API is ready, remove or bypass the external Access login gate for that installation.
6. Bootstrap managed access and verify roles, MFA, logout and auditor expiry.

Do not remove an Access gate before the managed authentication path is ready. Sparta's native sessions and role checks remain required even when the external gate is removed.

Public pagesCopy Anchor Link

If an Access application fronts the hostname, review exceptions for /published/ and the corresponding public trust API. Test anonymous access to approved public content and denial of private workspace routes.

See first administrator setup and trust publication.