SNACK: 3-line summary
- Cloudflare OHTTP Gateway has entered closed beta to hide users’ IP addresses from app backends.
- Independent relay and gateway operators separate IP information from request contents, but emails or usernames in the body can still identify users.
- Developers can join the waitlist for the planned paid add-on to a Cloudflare zone.
Cloudflare announced a closed beta for its OHTTP Gateway on October 2. The managed service lets developers receive app requests without seeing the user’s IP address, provided those requests arrive through an independently operated relay.
Snackgirls react
Nea: I’d like to see what an app sends when I sign in. A hidden IP is reassuring, but I’d still be curious whether my username goes along with later requests.
AIKO: I’d map what the relay knows and what the gateway knows in separate columns. Those empty cells would be the most interesting part of the table.
A managed gateway joins Cloudflare’s relay
The Gateway is planned as a paid add-on to a Cloudflare zone, with a full launch planned for this fall. The announcement is for a closed beta, rather than general availability.
Cloudflare’s existing Privacy Gateway, launched in 2022, is being renamed Cloudflare OHTTP Relay. That service requires developers to operate their own independent gateway. The new Gateway gives apps behind Cloudflare’s CDN or built on Workers another option: use Cloudflare’s managed gateway with a third-party relay.
The relay sees the IP; the gateway sees the contents
OHTTP, short for Oblivious HTTP, is an IETF standard that allows app backends to receive HTTP requests without learning the user’s original IP address. Its privacy model depends on independent, non-colluding relay and gateway operators, so no single party sees both the client’s network identifiers and the decrypted request.
The relay can see the user’s IP address and TLS fingerprint, but it forwards encrypted request content that it cannot read. The gateway decrypts the request for the app server; along this path, the gateway and app see the relay’s source IP rather than the user’s.
A username in the request can still identify you
OHTTP does not remove identifying data from the request body. If an app includes an email address or username, that information still reaches the backend. Developers need to keep those details out of requests intended to preserve user privacy.
Ordinary HTTP traffic does not invoke the Gateway. Enabling it does not convert existing browser or API requests into OHTTP. Users get the network-level protection only for requests their app has implemented through the OHTTP path.
Developers need a client and an independent relay
Developers need to implement an OHTTP client and arrange an independently operated third-party relay. To preserve that separation, the Gateway refuses to decrypt relay traffic sent from Cloudflare Workers or Cloudflare-proxied hosts. This restriction concerns the relay; the app itself can still run on Workers.
Developers interested in the beta can join Cloudflare’s official waitlist at https://www.cloudflare.com/lp/privacy-edge/. For app users, the benefit depends on developers adopting OHTTP correctly—there is no new consumer privacy switch everyone can turn on.
Sources and checked date: October 3, 2026