Cloudflare opened a closed beta for its Cloudflare OHTTP Gateway this week, introducing a paid zone add-on designed to help application developers hide end-user network identities from backend servers without altering their existing origin code. The software implements the IETF standard. Known as Oblivious HTTP (OHTTP), the protocol splits network requests between two independent intermediaries so that no single organization ever learns both who is sending the data and what information the inner HTTP request actually contains. Teams can now enable gateway handling on their zones with a few clicks [1].
Splitting Network Trust with OHTTP Gateway
Every standard web connection leaks client metadata. Application backends learn client IP addresses automatically because every network packet carries a source address like a sender label on an envelope, while servers also inspect incoming connections to build fingerprints out of supported TLS versions and cipher suites. For example, an unprotected exchange can reveal client IP 192.0.2.33 on ASN 7922 using AEAD-CHACHA20-POLY1305-SHA256 from Campbell, California, creating an exact geographical and device footprint [1].
Oblivious HTTP breaks that tracking chain by routing traffic through two separate hops known as a relay and a gateway, where the relay observes incoming client IP addresses but cannot inspect message contents encapsulated with Hybrid Public Key Encryption (HPKE). The relay then strips client identifiers and forwards ciphertext to the gateway from its own address, such as 128.62.37.13 on ASN 18 in Austin, Texas. Engineers call this a “double-blind” privacy model. Because the gateway decapsulates the message and forwards plain HTTP to the origin server, neither intermediary ever holds both pieces of the puzzle needed to link a specific user identity to an application request [1].
Consumer applications already use this dual-hop structure. Health tracking company Flo Health uses OHTTP to power its Anonymous Mode, allowing people to log sensitive personal health entries without tying medical records back to their real IP addresses or network locations. Apple also relies on OHTTP architecture in Apple Private Cloud Compute to separate artificial intelligence inference prompts from device account profiles and hardware identifiers [2].
Renaming Privacy Gateway to Cloudflare OHTTP Relay
Cloudflare also reorganized its product naming. The company rebranded its existing Privacy Gateway service, first launched in 2022, as Cloudflare OHTTP Relay to clarify which side of the Oblivious HTTP connection it handles for each deployment scenario. When companies ran applications behind Cloudflare CDN or Cloudflare Workers in the past, they couldn’t safely use Cloudflare’s relay service because doing so would’ve allowed Cloudflare to see both the incoming client IP address and the decrypted HTTP request [1]. That combined visibility would destroy the privacy guarantee.
Developers now face two distinct paths depending on where their backends live, meaning that teams hosting application servers off Cloudflare can run Cloudflare OHTTP Relay as the first hop while managing their own private gateway server elsewhere on the web [1]. The new gateway flips that setup.
If servers already sit behind Cloudflare’s network, teams can activate Cloudflare OHTTP Gateway on their zone and rely on a third-party relay like Apple LiveCallerID to send blinded traffic without needing to manage separate decryption hardware or complicated certificate pipelines. The gateway even blocks requests coming from Cloudflare Workers or proxied Cloudflare hosts, refusing to decrypt them so customer misconfigurations won’t accidentally collapse the trust boundary. These identity protections arrive while web operators reevaluate automated bots, such as when a Cloudflare founders letter warns AI bots surpass human traffic across automated network routes [1].
Edge Infrastructure and Public Key Management
Because proxy architectures force network requests to travel extra hops across the internet before reaching origin hardware, Cloudflare counters latency penalties by deploying its OHTTP Gateway across every server on its global anycast edge network rather than funneling traffic through centralized regional hubs [1].
If a customer’s origin already uses Cloudflare CDN, incoming requests decapsulate on the edge and resolve on the exact same metal, eliminating extra gateway-to-origin hops and keeping response times comparable to standard web traffic. Earlier engineering projects laid this foundation. Cloudflare said that earlier systems built to support both the 1.1.1.1 DNS resolver and Apple’s iCloud Private Relay serve as the performance base for this gateway, ensuring fast connection handling even under heavy global request volumes [1].
Cloudflare OHTTP Gateway automates cryptographic key management by generating public keys and publishing them directly at a /.well-known/ohttp-gateway zone endpoint where clients can fetch configurations through standard GET requests. Clients can download keys over different IPs. The service supports both standard OHTTP and chunked OHTTP, which streams data in incremental chunks so application servers don’t have to wait for large payloads to buffer before beginning request processing. App administrators can also place Cloudflare Access policies in front of the gateway to authenticate relays using mutual TLS, static service credentials, or custom logic [1].
Application Server Setup and Client Data Hygiene
Building a custom application gateway involves running a server that advertises its public key configuration through an API and decapsulates incoming envelopes. To simplify that server configuration, Cloudflare’s official developer documentation lists ready-to-use libraries in Go, Rust, and JavaScript or TypeScript [3].
These server libraries handle incoming encrypted envelopes, decapsulate inner requests, and produce encrypted responses before sending data back through the relay, while developers can also craft custom logic following the IETF standard’s public specifications. Client configuration follows a similar pattern. Developers can integrate client libraries written in Rust, JavaScript, TypeScript, or study an Objective C sample application provided in Cloudflare’s developer guides to see how client devices discover keys and format outbound envelopes. On mobile platforms like Apple iOS, documentation advises developers to encrypt application data locally on the device using KeyChain synchronization where possible, with similar client-side keystores recommended for Android [3].
Deploying an oblivious gateway doesn’t automatically guarantee complete user anonymity if the inner payload leaks identifying details, leading official setup guidelines to warn teams to scrub personal records like user names, phone numbers, and email addresses from every outbound request body. Developers should also prompt users to disable automatic crash reporting inside privacy modes, because memory crash dumps often package sensitive account identifiers and background data. Before sending requests through the relay, developers must contact Cloudflare and supply the exact URL of their application gateway server to establish routing conventions [3].
What Are the Main Cloudflare OHTTP Gateway Concerns?
The closed beta announcement triggered debate across developer forums regarding infrastructure centralization. On daily.dev, an online community discussion gathered 90 comments centered on Cloudflare’s growing footprint across internet infrastructure and the broader implications of relying on commercial intermediaries for user privacy. Commenters voiced skepticism about centralizing privacy services inside a single global provider, with several participants sharing jokes about surveillance agencies and raising man-in-the-middle concerns about whether trust is truly eliminated or merely shifted to Cloudflare’s network edge [4].
Hacker News readers weighed similar engineering compromises. Community analysis highlighted on hn.today examined the balance between anonymity gains and latency penalties, noting that services like private DNS resolution and privacy-focused APIs must accept the overhead of multi-hop routing and cryptographic processing to keep client identities obscured [5]. Widespread adoption depends on simplifying that deployment.
Cloudflare is accepting applications for the closed beta through an online registration form, with general availability planned for later this fall so that customers can enable the gateway as a paid add-on on their existing zones. Open-source client and relay tools stay available. As privacy standards mature across the web ecosystem, the arrival of managed gateways provides an accessible testing ground for applications seeking to eliminate user tracking at the network layer without sacrificing server performance or operational reliability [1].
- PRESS RELEASE Cloudflare. (2026, October 2). Announcing Cloudflare OHTTP Gateway – expanding access to Cloudflare’s privacy-preserving infrastructure. Cloudflare Blog. [Article Link]
- WEBSITE Cloudflare. (2026, October 2). Overview. Cloudflare OHTTP Relay Documentation. [Article Link]
- WEBSITE Cloudflare. (2026, October 2). Get started. Cloudflare OHTTP Relay Documentation. [Article Link]
- ONLINE NEWS daily.dev. (2026, October 2). Announcing Cloudflare OHTTP Gateway – expanding access to Cloudflare’s privacy-preserving infrastructure. daily.dev. [Article Link]
- ONLINE NEWS hn.today. (2026, October 3). Cloudflare Ohttp Gateway. hn.today. [Article Link]
