diff --git a/.github/build-setup.yml b/.github/build-setup.yml
index 188b7a7..04f57ba 100644
--- a/.github/build-setup.yml
+++ b/.github/build-setup.yml
@@ -3,7 +3,7 @@
 - name: Generate .env from Doppler secrets
   # Only the keys build.rs compiles into the binary
   shell: bash
-  run: doppler secrets download --no-file --format env | grep -E '^(SITE_HOST|CONVEX_HTTP_URL|PLAYSITE_HOST)=' > .env
+  run: doppler secrets download --no-file --format env | grep -E '^(SITE_HOST|CONVEX_HTTP_URL|PLAYSITE_HOST|CF_ACCESS_CLIENT_ID|CF_ACCESS_CLIENT_SECRET)=' > .env
   env:
     DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN }}
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e69830b..908ee58 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -130,7 +130,7 @@ jobs:
       - name: "Install Doppler CLI"
         uses: "dopplerhq/cli-action@v4"
       - name: "Generate .env from Doppler secrets"
-        run: "doppler secrets download --no-file --format env | grep -E '^(SITE_HOST|CONVEX_HTTP_URL|PLAYSITE_HOST)=' > .env"
+        run: "doppler secrets download --no-file --format env | grep -E '^(SITE_HOST|CONVEX_HTTP_URL|PLAYSITE_HOST|CF_ACCESS_CLIENT_ID|CF_ACCESS_CLIENT_SECRET)=' > .env"
         shell: "bash"
         env:
           "DOPPLER_TOKEN": "${{ secrets.DOPPLER_TOKEN }}"
diff --git a/build.rs b/build.rs
index 3e3fb94..f52ccdb 100644
--- a/build.rs
+++ b/build.rs
@@ -22,9 +22,20 @@ fn main() {
     };
     println!("cargo:rustc-env=CONFIG_DIR={}", config_dir);
 
+    // Optional Cloudflare Access credentials (only needed for staging)
+    let optional = ["CF_ACCESS_CLIENT_ID", "CF_ACCESS_CLIENT_SECRET"];
+
+    for var in optional {
+        if let Ok(value) = std::env::var(var) {
+            println!("cargo:rustc-env={}={}", var, value);
+        }
+    }
+
     println!("cargo:rerun-if-changed=.env");
     println!("cargo:rerun-if-env-changed=SITE_HOST");
     println!("cargo:rerun-if-env-changed=CONVEX_HTTP_URL");
     println!("cargo:rerun-if-env-changed=PLAYSITE_HOST");
+    println!("cargo:rerun-if-env-changed=CF_ACCESS_CLIENT_ID");
+    println!("cargo:rerun-if-env-changed=CF_ACCESS_CLIENT_SECRET");
 }
 
diff --git a/src/config.rs b/src/config.rs
index 9b15026..526b900 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -54,6 +54,8 @@ struct Config {
     /// — serves the default-entrypoint scripts `wavedash dev` boots engine
     /// builds with. https-prefixed here like site_host.
     playsite_host: String,
+    cf_access_client_id: Option<String>,
+    cf_access_client_secret: Option<String>,
 }
 
 impl Config {
@@ -75,6 +77,8 @@ impl Config {
             open_browser_website_host: site_host,
             api_host: env!("CONVEX_HTTP_URL").to_string(),
             playsite_host,
+            cf_access_client_id: option_env!("CF_ACCESS_CLIENT_ID").map(|s| s.to_string()),
+            cf_access_client_secret: option_env!("CF_ACCESS_CLIENT_SECRET").map(|s| s.to_string()),
         })
     }
 }
@@ -99,14 +103,38 @@ pub fn credentials_path() -> Result<PathBuf> {
 /// "please upgrade" prompts without parsing User-Agent.
 pub const CLI_VERSION_HEADER: &str = "X-Wavedash-CLI-Version";
 
-/// Create an HTTP client configured with the CLI version header.
+/// Create an HTTP client configured with the CLI version header (always)
+/// and Cloudflare Access headers (only on staging when creds are baked in).
 pub fn create_http_client() -> Result<reqwest::Client> {
+    let config = Config::load()?;
+
     let mut headers = reqwest::header::HeaderMap::new();
     headers.insert(
         CLI_VERSION_HEADER,
         reqwest::header::HeaderValue::from_static(env!("CARGO_PKG_VERSION")),
     );
 
+    let api_host = &config.api_host;
+    let needs_cf_headers = api_host
+        .trim_start_matches("https://")
+        .trim_start_matches("http://")
+        .ends_with("staging.wavedash.gg");
+
+    if needs_cf_headers {
+        if let (Some(client_id), Some(client_secret)) =
+            (&config.cf_access_client_id, &config.cf_access_client_secret)
+        {
+            headers.insert(
+                "CF-Access-Client-Id",
+                reqwest::header::HeaderValue::from_str(client_id)?,
+            );
+            headers.insert(
+                "CF-Access-Client-Secret",
+                reqwest::header::HeaderValue::from_str(client_secret)?,
+            );
+        }
+    }
+
     Ok(reqwest::Client::builder().default_headers(headers).build()?)
 }