diff --git a/docs/auth/cloudflare/provider.md b/docs/auth/cloudflare/provider.md
index 516ea9d647..a1946580a7 100644
--- a/docs/auth/cloudflare/provider.md
+++ b/docs/auth/cloudflare/provider.md
@@ -32,6 +32,12 @@ auth:
       serviceTokens:
         - token: '1uh2fh19efvfh129f1f919u21f2f19jf2.access'
           subject: 'bot-user@your-company.com'
+      # You can customize the header name that contains the jwt token, by default
+      # cf-access-jwt-assertion is used
+      jwtHeaderName: <my-header>
+      # You can customize the authorization cookie name, by default
+      # CF_Authorization is used
+      authorizationCookieName: <MY_CAUTHORIZATION_COOKIE_NAME>
       # This picks what sign in resolver(s) you want to use.
       signIn:
         resolvers:
diff --git a/plugins/auth-backend-module-cloudflare-access-provider/src/helpers.ts b/plugins/auth-backend-module-cloudflare-access-provider/src/helpers.ts
index b3fefb8789..3077258dd6 100644
--- a/plugins/auth-backend-module-cloudflare-access-provider/src/helpers.ts
+++ b/plugins/auth-backend-module-cloudflare-access-provider/src/helpers.ts
@@ -40,10 +40,10 @@ export class AuthHelper {
     options?: { cache?: CacheService },
   ): AuthHelper {
     const teamName = config.getString('teamName');
-    const jwtHeaderName = config.getOptionalString('jwtHeaderName');
-    const authorizationCookieName = config.getOptionalString(
-      'authorizationCookieName',
-    );
+    const jwtHeaderName =
+      config.getOptionalString('jwtHeaderName') ?? CF_JWT_HEADER;
+    const authorizationCookieName =
+      config.getOptionalString('authorizationCookieName') ?? COOKIE_AUTH_NAME;
     const serviceTokens = (
       config.getOptionalConfigArray('serviceTokens') ?? []
     )?.map(cfg => {
@@ -60,37 +60,35 @@ export class AuthHelper {
     return new AuthHelper(
       teamName,
       serviceTokens,
-      keySet,
-      options?.cache,
       jwtHeaderName,
       authorizationCookieName,
+      keySet,
+      options?.cache,
     );
   }
 
   private constructor(
     private readonly teamName: string,
     private readonly serviceTokens: ServiceToken[],
+    private readonly jwtHeaderName: string,
+    private readonly authorizationCookieName: string,
     private readonly keySet: ReturnType<typeof createRemoteJWKSet>,
     private readonly cache?: CacheService,
-    private readonly jwtHeaderName?: string,
-    private readonly authorizationCookieName?: string,
   ) {}
 
   async authenticate(req: express.Request): Promise<CloudflareAccessResult> {
     // JWTs generated by Access are available in a request header as
     // Cf-Access-Jwt-Assertion and as cookies as CF_Authorization.
-    let jwt = req.header(this.jwtHeaderName || CF_JWT_HEADER);
+    let jwt = req.header(this.jwtHeaderName);
     if (!jwt) {
-      jwt = req.cookies[this.authorizationCookieName || COOKIE_AUTH_NAME];
+      jwt = req.cookies[this.authorizationCookieName];
     }
     if (!jwt) {
       // Only throw if both are not provided by Cloudflare Access since either
       // can be used.
       throw new AuthenticationError(
-        `Missing ${this.jwtHeaderName || CF_JWT_HEADER} and 
-          ${
-            this.authorizationCookieName || COOKIE_AUTH_NAME
-          } from Cloudflare Access`,
+        `Missing ${this.jwtHeaderName} and 
+          ${this.authorizationCookieName} from Cloudflare Access`,
       );
     }
 
@@ -171,11 +169,8 @@ export class AuthHelper {
   ): Promise<CloudflareAccessIdentityProfile> {
     const headers = new Headers();
     // set both headers just the way inbound responses are set
-    headers.set(this.jwtHeaderName || CF_JWT_HEADER, jwt);
-    headers.set(
-      'cookie',
-      `${this.authorizationCookieName || COOKIE_AUTH_NAME}=${jwt}`,
-    );
+    headers.set(this.jwtHeaderName, jwt);
+    headers.set('cookie', `${this.authorizationCookieName}=${jwt}`);
     try {
       const res = await fetch(
         `https://${this.teamName}.cloudflareaccess.com/cdn-cgi/access/get-identity`,