OKNote
Getting Started

🌐 Public Access: Your Own Domain + Cloudflare

Running OKNote on a NAS at home, you can reach it only on your local network by default. To open your OKNote from the office, on the road, anywhere, you need "public mapping." OKNote has a built-in Cloudflare Tunnel option:

  • No public IP and no port forwarding on your router — a carrier-grade NAT / private IP from your ISP is fine;
  • Uses your own domain for the address (e.g. https://notes.example.com) over Cloudflare's encrypted tunnel — secure and stable.

Prerequisites: public mapping is a Family-plan-and-above capability; Free doesn't include it. Also, the tunnel host must be a server build (NAS / desktop server); the Mac App Store IAP edition runs in a sandbox and can't act as the tunnel host.

The whole thing is done in the 4-step wizard under Settings → Public Mapping → "Set up public access · Bring your own domain." Below is the step-by-step. The critical part is Step 3, getting the token — read it carefully and you won't get stuck.

Step 1: Have a domain ready

You need a domain of your own to build the address from.

  • Already have one (bought at GoDaddy, Namecheap, Aliyun, etc.) → use it, go to Step 2.
  • No domain yet → buy one at Cloudflare Registrar, GoDaddy, or elsewhere; usually a few dollars a year. .com / .top / .xyz all work.

Step 2: Add your domain to Cloudflare

This step hands your domain's DNS management to Cloudflare.

  1. Sign up and log in to the Cloudflare dashboard (free).
  2. Click Add a site and enter your domain.
  3. Choose the Free plan. Cloudflare gives you two nameserver (DNS server) addresses.
  4. Go back to where you bought the domain and change its nameservers to the two Cloudflare gave you:
    • GoDaddy: My Domains → open the domain's Domain Settings → Nameservers → Change → choose Custom → enter the two, save.
    • Namecheap / others: find the "Nameservers" setting, switch to Custom DNS, enter the two, save.
  5. Wait for the domain's status in Cloudflare to become Active — usually a few minutes to a few hours.

If you bought the domain at Cloudflare Registrar in the first place, it's already connected — skip this step.

Step 3: Create an API Token (🔑 the critical step)

This gives OKNote a "key" so it can automatically build the tunnel and configure DNS under your domain. The whole difficulty is here, and it's all about granting the right permissions.

  1. Open the Cloudflare API Tokens page.

  2. Click Create Token → scroll to the bottom, Create Custom Token → Get started.

  3. Under Permissions, add these three rows exactly (click "+ Add more" for extra rows):

    Column 1 (group) Column 2 (item) Column 3 (level)
    Account Cloudflare Tunnel Edit
    Zone DNS Edit
    Zone Zone Read

    All three are required: row 1 lets OKNote build the tunnel, row 2 lets it configure your access domain's DNS, row 3 lets it read your list of domains.

  4. Below that:

    • Account Resources: select your own account.
    • Zone Resources: select the domain you'll use (or All zones).

  5. Click Continue to summary → Create Token, then copy the generated token.

    ⚠️ The token is shown only once. Copy it before you leave the page — if you lose it you'll have to create a new one.

  6. Bring the copied token to Step 4 of the wizard.

Step 4: Fill in and activate

Back in the OKNote wizard, Step 4:

  1. Domain: your root domain, e.g. example.com (no https://, no subdomain).
  2. Subdomain: your access prefix, default notes. As you type, the wizard shows your address live, e.g. https://notes.example.com.
  3. Cloudflare API Token: paste the token from Step 3.
  4. Click Verify domain and token — on success you'll see a green "Verified, ready to activate."

    Verification failing? Most likely a permission row is missing in Step 3, or the domain is mistyped / not yet Active. Go back and check the three rows.

  5. Click Activate. After a moment your public address goes live.

From then on, open https://notes.your-domain on any network to reach this OKNote.

FAQ

  • Do I really need a domain? Yes — bring-your-own-domain needs a domain of your own (a few dollars a year). That way the address is yours, clean and stable.
  • Verification keeps failing? Check in order: ① all three permission rows in Step 3 are present and the group/item/level match; ② the domain is Active in Cloudflare; ③ no typos in the domain and the token was copied in full.
  • Activated but won't open? DNS takes a little time to propagate right after you connect a domain; make sure the server itself is online with internet access (the server builds the tunnel outbound to Cloudflare).
  • Change domain / turn it off? Go back to Settings → Public Mapping to reconfigure or disable public access.

📸 Cloudflare occasionally moves buttons around, but the core — "Create Custom Token" plus the three permission rows above — doesn't change. Trust the permission table and you'll be fine.

That's the end of the guides 🎉 Feel free to edit or delete these notes — nothing will break. Enjoy OKNote!