diff --git a/plugins/auth-backend/api-report.md b/plugins/auth-backend/api-report.md
index 0e7219ba88..649a31c963 100644
--- a/plugins/auth-backend/api-report.md
+++ b/plugins/auth-backend/api-report.md
@@ -171,8 +171,34 @@ export class CatalogIdentityClient {
   resolveCatalogMembership(query: MemberClaimQuery): Promise<string[]>;
 }
 
-// Warning: (ae-missing-release-tag) "CloudflareAccessResult" is exported by the package, but it is missing a release tag (@alpha, @beta, @public, or @internal)
-//
+// @public
+export type CloudflareAccessClaims = {
+  aud: string[];
+  email: string;
+  exp: number;
+  iat: number;
+  nonce: string;
+  identity_nonce: string;
+  sub: string;
+  iss: string;
+  custom: string;
+};
+
+// @public
+export type CloudflareAccessGroup = {
+  id: string;
+  name: string;
+  email: string;
+};
+
+// @public
+export type CloudflareAccessIdentityProfile = {
+  id: string;
+  name: string;
+  email: string;
+  groups: CloudflareAccessGroup[];
+};
+
 // @public (undocumented)
 export type CloudflareAccessResult = {
   claims: CloudflareAccessClaims;
@@ -740,9 +766,4 @@ export type WebMessageResponse =
       type: 'authorization_response';
       error: Error;
     };
-
-// Warnings were encountered during analysis:
-//
-// src/providers/cloudflare-access/provider.d.ts:77:5 - (ae-forgotten-export) The symbol "CloudflareAccessClaims" needs to be exported by the entry point index.d.ts
-// src/providers/cloudflare-access/provider.d.ts:78:5 - (ae-forgotten-export) The symbol "CloudflareAccessIdentityProfile" needs to be exported by the entry point index.d.ts
 ```
diff --git a/plugins/auth-backend/src/providers/cloudflare-access/index.ts b/plugins/auth-backend/src/providers/cloudflare-access/index.ts
index c56b0bba5f..10390af7de 100644
--- a/plugins/auth-backend/src/providers/cloudflare-access/index.ts
+++ b/plugins/auth-backend/src/providers/cloudflare-access/index.ts
@@ -14,4 +14,9 @@
  * limitations under the License.
  */
 export { cfAccess } from './provider';
-export type { CloudflareAccessResult } from './provider';
+export type {
+  CloudflareAccessClaims,
+  CloudflareAccessGroup,
+  CloudflareAccessResult,
+  CloudflareAccessIdentityProfile,
+} from './provider';
diff --git a/plugins/auth-backend/src/providers/cloudflare-access/provider.ts b/plugins/auth-backend/src/providers/cloudflare-access/provider.ts
index b862e3c6de..a2c16fcebf 100644
--- a/plugins/auth-backend/src/providers/cloudflare-access/provider.ts
+++ b/plugins/auth-backend/src/providers/cloudflare-access/provider.ts
@@ -64,7 +64,14 @@ export type Options = {
   cache?: CacheClient;
 };
 
-/** @public */
+/**
+ * CloudflareAccessClaims
+ *
+ * Can be used in externally provided auth handler or sign in resolver to
+ * enrich user profile for sign-in user entity
+ *
+ * @public
+ */
 export type CloudflareAccessClaims = {
   /**
    * `aud` identifies the application to which the JWT is issued.
@@ -103,19 +110,45 @@ export type CloudflareAccessClaims = {
   custom: string;
 };
 
-type CloudflareAccessGroup = {
+/**
+ * CloudflareAccessGroup
+ *
+ * @public
+ */
+export type CloudflareAccessGroup = {
+  /**
+   * Group id
+   */
   id: string;
+  /**
+   * Name of group as defined in Cloudflare zero trust dashboard
+   */
   name: string;
+  /**
+   * Access group email address
+   */
   email: string;
 };
 
-type CloudflareAccessIdentityProfile = {
+/**
+ * CloudflareAccessIdentityProfile
+ *
+ * Can be used in externally provided auth handler or sign in resolver to
+ * enrich user profile for sign-in user entity
+ *
+ * @public
+ */
+export type CloudflareAccessIdentityProfile = {
   id: string;
   name: string;
   email: string;
   groups: CloudflareAccessGroup[];
 };
 
+/**
+ *
+ * @public
+ */
 export type CloudflareAccessResult = {
   claims: CloudflareAccessClaims;
   cfIdentity: CloudflareAccessIdentityProfile;
diff --git a/plugins/auth-backend/src/providers/index.ts b/plugins/auth-backend/src/providers/index.ts
index 363c89cb28..83dd1c6c1f 100644
--- a/plugins/auth-backend/src/providers/index.ts
+++ b/plugins/auth-backend/src/providers/index.ts
@@ -20,7 +20,12 @@ export type {
   BitbucketOAuthResult,
   BitbucketPassportProfile,
 } from './bitbucket';
-export type { CloudflareAccessResult } from './cloudflare-access';
+export type {
+  CloudflareAccessClaims,
+  CloudflareAccessGroup,
+  CloudflareAccessResult,
+  CloudflareAccessIdentityProfile,
+} from './cloudflare-access';
 export type { GithubOAuthResult } from './github';
 export type { OAuth2ProxyResult } from './oauth2-proxy';
 export type { OidcAuthResult } from './oidc';