cf-warp-wireguard-gen

A CLI tool to generate WireGuard configuration files for Cloudflare WARP.

Features

• Generate WireGuard configs for standard Cloudflare WARP
• Support for WARP+ license keys
• Cloudflare Zero Trust (Teams) enrollment via JWT token
• Optional credential saving for later reuse

Installation

From source

cargo install --path .

Build from source

cargo build --release

The binary will be available at target/release/cf-warp-wireguard-gen.

Usage

Basic usage (free WARP)

cf-warp-wireguard-gen > warp.conf

With WARP+ license

cf-warp-wireguard-gen --license YOUR_WARP_PLUS_LICENSE > warp.conf

Cloudflare Zero Trust (Teams) enrollment

cf-warp-wireguard-gen --teams-jwt YOUR_JWT_TOKEN > warp.conf

Obtaining the JWT token

1. Visit https://<team-name>.cloudflareaccess.com/warp
2. Authenticate as you would with the official WARP client
3. Extract the JWT token from the page source or use browser console:

   console.log(document.querySelector("meta[http-equiv='refresh']").content.split("=")[2])

Command-line options

Options:
  -l, --license <LICENSE>          WARP+ license key (purchased through the official 1.1.1.1 app)
  -t, --teams-jwt <TEAMS_JWT>      Cloudflare for Teams JWT token for Zero Trust enrollment
  -n, --device-name <DEVICE_NAME>  Device name shown in the Zero Trust dashboard (only with --teams-jwt)
  -s, --serial-number <SERIAL>     Device serial number (only with --teams-jwt)
  -m, --device-model <MODEL>       Device model name displayed in the 1.1.1.1 app [default: PC]
      --save-credentials <PATH>    Output credentials as JSON (for later reuse)
  -h, --help                       Print help
  -V, --version                    Print version

Saving credentials

To save credentials for later reuse:

cf-warp-wireguard-gen --save-credentials credentials.json > warp.conf

Output

The tool outputs a standard WireGuard configuration file to stdout:

[Interface]
PrivateKey = <base64-encoded-private-key>
Address = <tunnel-ip>/32
DNS = 1.1.1.1

[Peer]
PublicKey = <base64-encoded-public-key>
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = <warp-endpoint>
PersistentKeepalive = 25

For Teams enrollment, the Client ID (Reserved field) is also printed to stderr.

Dependencies

This tool uses the warp-wireguard-gen library.

License

This project is licensed under the GNU General Public License v3.0 - see the LICENSE file for details.

Disclaimer

This tool is not affiliated with Cloudflare. Use at your own risk and in accordance with Cloudflare's Terms of Service.