# Allowlist: Cloudflare MCP Server Portals

**URL:** <https://developer.squareup.com/forums/t/allowlist-cloudflare-mcp-server-portals/27899>\
**Category:** MCP\
**Created:** [September 19, 2026, 6:52pm UTC](https://developer.squareup.com/forums/t/allowlist-cloudflare-mcp-server-portals/27899 "2026-09-19T18:52:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cheekyvaughan](https://avatars.discourse-cdn.com/v4/letter/c/a5b964/32.png) [@Cheekyvaughan](https://developer.squareup.com/forums/u/Cheekyvaughan)\
**Post date:** [September 19, 2026, 6:52pm UTC](https://developer.squareup.com/forums/t/allowlist-cloudflare-mcp-server-portals/27899/1 "2026-09-19T18:52:59Z")

</div>

Hi,

Please add this redirect URI to the square MCP server’s client allowlist: `https://auth-callbacks.cloudflareaccess.com/cdn-cgi/access/outbound-oauth-callback`  
This is Cloudflare’s shared 0Auth callback for MCP Server Portals, so allowlisting it would enable every Cloudflare customer. Registration currently fails with “invalid\_redirect\_uri - domain not in allowlist”.

Client details: public client (token\_endpoint\_auth\_method: none, PKCE S256), authorization\_code and refresh\_token grants, production only.

Use case: reading Square data, mainly with read scopes, to reconcile payments and payouts against our books.

Thanks!

---

<div class="post-metadata">

**Author:** ![zacstlouis](https://avatars.discourse-cdn.com/v4/letter/z/b5a626/32.png) [@zacstlouis](https://developer.squareup.com/forums/u/zacstlouis)\
**Post date:** [September 22, 2026, 3:23pm UTC](https://developer.squareup.com/forums/t/allowlist-cloudflare-mcp-server-portals/27899/4 "2026-09-22T15:23:08Z")

</div>

I have added the oauth callback. It may take up to 5 business days to take effect.