Account context in Access deny redirects

App-aware Cloudflare Access deny redirects include an account_id query parameter when account context is available. Custom block pages can use it to identify the account that owns the application represented by kid.

For example, a custom redirect can include:

https://denied.example.com/?kid=<APP_AUD>&account_id=<ACCOUNT_ID>&original_url=app.example.com%2Fadmin

The account ID helps block-page integrations look up applications through account-scoped APIs. It is context, not proof of authentication or authorization.

For parameter descriptions and an example, refer to Custom redirect URL parameters.