Join a mesh

The mesh is closed by default — only explicitly added emails or auth keys can join.

Interactive join (laptops & desktops)

An admin adds the person first:

jalth role set sarah@team.com member

Then the person runs:

jalth join https://jalth.myteam.workers.dev

$ jalth join https://jalth.myteam.workers.dev

? Device name: sarah-laptop

Opening browser for authentication...
  ✓ Authenticated as sarah@team.com

Enrolling device...
  ✓ WARP registered to team "myteam"
  ✓ Device registered as "sarah-laptop"
  ✓ CGNAT IP: 100.96.0.2

If the email is not in jalth-members, Cloudflare Access blocks enrollment before the Worker is reached.

Auth key join (headless servers)

An operator or admin creates a key:

jalth auth-key create homelab --reusable --expires-in 7d

The server joins without a browser:

jalth join https://jalth.myteam.workers.dev --auth-key jalth_auth_...access.S3cr3tTokenValue

Auth key options

Flag	Description
<name>	Human-readable label
--reusable	Multiple devices can use the same key
--expires-in <duration>	Expiration (7d, 24h, 30d)
--tag <tag>	Tag applied to joining devices
--identity <email>	Email for role assignment (no IdP verification)
--group <group>	Access Group to add identity to (requires --identity)

Cloud-init / Terraform

runcmd:
  - curl -fsSL https://pkg.cloudflare.com/cloudflare-warp-install.sh | bash
  - curl -fsSL https://jalth.vinaypuppal.com/install.sh | sh
  - jalth join https://jalth.myteam.workers.dev --auth-key ${AUTH_KEY}

Pin the CLI version in automation instead of always taking latest.

WARP enrollment

Both init and join enroll the device in Cloudflare WARP. Include-mode split tunnel routes only mesh traffic through WARP — regular internet traffic is unaffected.

Flow	Environment	Enrollment
Interactive join	Browser available	warp-cli registration new opens SSO
Auth key join	Headless	MDM with service token creds, auto-enroll on restart

MDM file locations:

• macOS: /Library/Application Support/Cloudflare/mdm.xml
• Linux: /var/lib/cloudflare-warp/mdm.xml

Note

Writing the MDM profile requires sudo. If WARP is enrolled in a different Zero Trust org, jalth join asks you to leave first.

Device identity

Property	Description
Name	3–30 chars, lowercase alphanumeric + hyphens
CGNAT IP	Stable 100.96.x.x address
Device token	Authenticates API calls to the Registry Worker
Role	admin, operator, or member

Token expiry: SSO devices expire after 90 days of inactivity. Auth-key devices never expire.

Leave the mesh

jalth leave

Removes your device and all associated Cloudflare resources. Admins can remove others with jalth devices remove <name>.