[Workers] Document Access Service Auth setup for remote bindings

[petebacondarwin]

Summary

Expands the Wrangler remote bindings docs to document the full Cloudflare Access Service Auth setup required when running Wrangler against an Access-protected Worker. Previously the only guidance was a single bullet noting the CLOUDFLARE_ACCESS_CLIENT_ID / CLOUDFLARE_ACCESS_CLIENT_SECRET env vars exist, with no mention of the Access policy or service token setup needed for those vars to work.

This change:

• Promotes the existing one-line bullet under "Important Considerations" into a new ### Connecting to Access-protected Workers subsection on the remote bindings page.
• Adds a 3-step <Steps> procedure covering: attaching a Service Auth policy to the existing Access application that protects the Worker's hostname, creating a service token, and exposing the credentials to Wrangler.
• Includes the OpenNext-discovered caveat that creating a separate Access app scoped to the Worker hostname can block requests, with a link to opennextjs-cloudflare#1171.
• Cross-links the CLOUDFLARE_ACCESS_CLIENT_ID / CLOUDFLARE_ACCESS_CLIENT_SECRET entries on the system environment variables page to the new subsection.

Prompted by cloudflare/workers-sdk#14008, which fixes a bug where Wrangler ignored these env vars when the Access app was configured to only accept Service Auth tokens. With that fix in place, the documented service-token flow now works reliably against the configuration OpenNext recommends, so the full setup steps are worth documenting in our own docs rather than only on the OpenNext side.

Documentation checklist

• The change adheres to the documentation style guide.

[github-actions]

This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:

Pattern	Owners
/src/content/docs/workers/	@cloudflare/workers-docs, @GregBrimble, @irvinebroque, @mikenomitch, @korinne, @WalshyDev, @cloudflare/deploy-config, @cloudflare/product-owners, @cloudflare/wrangler, @MattieTK, @cloudflare/dev-plat-leads
/src/content/docs/workers/wrangler/	@cloudflare/wrangler, @irvinebroque, @cloudflare/product-owners, @MattieTK

[ask-bonk]

Review complete for PR #31021.

Added labels: product:access, triage

Posted a review with 4 inline suggestions:

• CRITICAL — src/content/docs/workers/development-testing/index.mdx line 328: *.<account>.workers.dev contains an unescaped JSX tag (<account>) that will break the MDX build. Suggested wrapping it in backticks.
• MEDIUM — Line 314: "Worker's custom route" uses a possessive on an inanimate object; rephrased per style guide.
• MEDIUM — Line 338: Nested dashboard paths use → instead of the required plain > separator.
• LOW — Lines 345–346: Placeholder values use lowercase (<client-id>) instead of the style guide's ALL_CAPS_UNDERSCORES format.

I also flagged that the documentation style guide checklist in the PR description is still unchecked.

github run

[github-actions]

Preview URL: https://5822d4e3.preview.developers.cloudflare.com
Preview Branch URL: https://docs-access-protected-remote-bindings.preview.developers.cloudflare.com

Files with changes (up to 15)

Original Link	Updated Link
https://developers.cloudflare.com/workers/development-testing/	https://docs-access-protected-remote-bindings.preview.developers.cloudflare.com/workers/development-testing/
https://developers.cloudflare.com/workers/wrangler/system-environment-variables/	https://docs-access-protected-remote-bindings.preview.developers.cloudflare.com/workers/wrangler/system-environment-variables/

[ascorbic]

Ah, approved before seeing the Devin style guide follow-ups