Cloudflare OHTTP Gateway Enters Closed Beta as a Paid Zone Add-On

Cloudflare has opened a closed beta for its new OHTTP Gateway, a self-serve product that lets customers receive Oblivious HTTP traffic without seeing user IP addresses. The company announced the launch during its Birthday Week, and customers can join the waitlist through a registration form. Once enabled, the gateway is a paid add-on to a Cloudflare zone.

Oblivious HTTP is an IETF standard that splits a request across two independently operated hops: a relay and a gateway. The relay blindly forwards encrypted requests so client identifiers stay hidden from app servers, while the gateway handles the cryptographic work of decapsulating requests and encapsulating responses. Cloudflare says the separation of trust matters because it ensures no single party sees both client identifiers and request contents.

Cloudflare already runs the other half of the pair

Cloudflare launched an OHTTP relay product in 2022 under the name Privacy Gateway. As part of this announcement, that product is being renamed Cloudflare OHTTP Relay to distinguish it from the new gateway. According to Cloudflare, Flo Health uses OHTTP for its app’s Anonymous Mode, and Apple’s Private Cloud Compute uses OHTTP to disassociate AI inference requests from user identities.

The gap the gateway fills is structural. Customers already protecting their servers behind Cloudflare could not also use a Cloudflare-operated relay, because that would collapse the separation of trust. They needed a gateway instead.

Two ways to split the trust

Cloudflare frames the choice between its two products by deployment:

• Use Cloudflare’s OHTTP Relay and run your own gateway. Cloudflare says this suits applications hosted off Cloudflare whose operators can run a gateway themselves.
• Use Cloudflare’s new OHTTP Gateway with a third-party relay. Cloudflare says this suits app servers already behind its CDN or Workers, developers accepting OHTTP requests from a third party such as Apple’s LiveCallerID, or anyone wanting a managed gateway to reduce latency and operational overhead.

Cloudflare says running OHTTP relays showed how difficult it is to build and operate a secure, performant gateway at scale, and that developer appetite for usable privacy infrastructure is growing.

If you want in, the gateway is in closed beta and requires joining the waitlist; Cloudflare has not published pricing for the add-on.

Related reading

Sources

• Announcing Cloudflare OHTTP Gateway – expanding access to Cloudflare’s privacy-preserving infrastructure — Cloudflare Blog