TL;DR
Get business pricing on networking and server gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Cloudflare says its self-serve Oblivious HTTP Gateway is now in closed beta, complementing its existing OHTTP Relay. The two-hop protocol separates the relay that can see a user’s network identifiers from the gateway that processes request contents; Cloudflare says the relay and gateway must be operated by separate, non-colluding parties for that privacy model to hold.
Cloudflare has launched a closed beta of its self-serve Oblivious HTTP (OHTTP) Gateway, adding a managed option for app developers who want to conceal users’ network identifiers from application servers. The announcement also renames the company’s existing Privacy Gateway product as Cloudflare OHTTP Relay, making the two roles in its OHTTP offering distinct.
OHTTP sends requests through two separately operated services. The relay forwards encrypted requests and can see connection details such as a client’s IP address, while the gateway decrypts the request for the app server and encrypts the response. Under the protocol’s intended trust model, the relay and gateway are operated by separate, non-colluding parties, so neither service alone can associate a client’s network identity with the request contents.
Cloudflare said the new gateway is aimed in part at customers whose applications already run behind its infrastructure, including its CDN or Workers, and at developers receiving OHTTP traffic from third parties. Those customers can use a third-party relay with Cloudflare’s gateway. The company said customers can also continue using Cloudflare’s relay while operating their own gateway, an arrangement it describes as suitable when application servers are hosted elsewhere.
The company characterized the self-serve product as a closed beta. In the blog post, it said it planned to offer the gateway as a paid add-on to a Cloudflare zone and invited customers to join a waitlist. The supplied announcement does not state the beta’s participant count, pricing, or a specific public-release date.
A Managed Option for OHTTP Deployments
The gateway addresses an operational gap for developers who want to use OHTTP but do not want to build and run the gateway themselves. OHTTP adds an intermediary hop and cryptographic processing, which Cloudflare says can increase latency and operating demands. A managed gateway could reduce that burden for applications already using Cloudflare, though the announcement provides no independent performance measurements.
The change also gives developers a choice about which OHTTP role Cloudflare performs. That distinction matters because placing the relay and gateway under the same operator could weaken the separation of trust that the protocol relies on. Cloudflare’s stated model pairs its gateway with a third-party relay, or its relay with a gateway run by the customer. The announcement does not establish how customers will assess the independence or practices of any particular third party.
As an affiliate, we earn on qualifying purchases.
Cloudflare’s Relay Comes First
Cloudflare introduced its OHTTP relay product in 2022 under the name Privacy Gateway. It said that product lets customers offer OHTTP traffic through a relay, but customers must supply their own gateway to maintain the separation between the party that sees client identifiers and the party that handles request contents.
Cloudflare cited Flo Health’s Anonymous Mode and Apple’s Private Cloud Compute as examples of services using OHTTP. Those examples illustrate existing uses of the protocol; they are not evidence that either service uses the newly announced Cloudflare Gateway. The new product expands Cloudflare’s offering from the relay role to the gateway role and changes the former product’s name to clarify the difference.
Cloudflare says the gateway will run across its global edge network using its anycast infrastructure. It argues that this placement can shorten the relay-to-gateway leg and, for customers using its CDN, allow gateway processing near the application server. These are the company’s descriptions of the design and expected benefits, rather than reported benchmark results in the supplied material.
“OHTTP is an IETF standard designed to enable app backends to receive HTTP requests without seeing user IP addresses.”
— Cloudflare, in its OHTTP Gateway announcement
As an affiliate, we earn on qualifying purchases.
Beta Access and Performance Remain Open
The announcement does not specify when the closed beta will expand, how many customers can participate, or when the gateway will become generally available. Although Cloudflare said it planned a paid add-on, it did not provide pricing or describe the final service limits in the supplied report.
Cloudflare described latency reduction as a benefit of operating the gateway on its edge network, but it did not publish measurements comparing the service with customer-operated gateways or other providers. The announcement also does not detail the gateway’s data-handling policies, retention practices, or independent verification arrangements. Those details would help customers evaluate how the deployment fits their privacy and compliance requirements.
OHTTP’s protection depends on the separation of trust between relay and gateway. The announcement explains that principle but does not describe how customers can verify that a third-party relay and Cloudflare operate independently in practice. Nor does it establish that OHTTP prevents all forms of tracking; it addresses the exposure of client identifiers and request contents across the two services.
As an affiliate, we earn on qualifying purchases.
Cloudflare’s Next Beta Milestones
Cloudflare said interested customers can register through its form to join the waitlist. The next concrete milestones are broader beta access and the paid add-on release the company described as planned for the fall; the supplied announcement gives no calendar year or firm launch date. Cloudflare may provide pricing, availability, and configuration details as the beta develops.
For developers weighing adoption, the practical next steps are to confirm whether their app can accept OHTTP traffic, decide whether to run their own gateway or use Cloudflare’s, and identify a relay operated separately from the gateway. Any assessment of performance or privacy controls will depend on service details and measurements not included in the announcement.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Cloudflare announce?
Cloudflare announced a closed beta for a self-serve OHTTP Gateway and renamed its existing Privacy Gateway as Cloudflare OHTTP Relay.
What does an OHTTP gateway do?
The gateway processes an encrypted OHTTP request so an application server can handle it, then encrypts the response. The relay forwards the request and can see connection information, while the gateway handles the request contents.
Does the new gateway hide a user’s IP address from the relay?
Not by itself. In the described OHTTP design, the relay can see client connection details, while the gateway processes the request contents. The privacy model depends on the relay and gateway being operated separately so one party does not see both.
Who is the Cloudflare OHTTP Gateway intended for?
Cloudflare says it is suited to customers whose application servers already use its CDN or Workers, customers accepting OHTTP requests from third parties, and developers who want a managed gateway rather than operating one themselves.
When will the gateway be generally available, and what will it cost?
The announcement does not give a general-availability date or price. Cloudflare said it planned to offer the product as a paid add-on and invited customers to join the waitlist for the closed beta.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
