Cloudflare’s OHTTP Gateway enters closed beta

Summary

Cloudflare has opened a closed beta for a managed Oblivious HTTP (OHTTP) Gateway. It gives developers a hosted gateway for applications behind Cloudflare while requiring a separate relay operator to keep user identity apart from request contents. General availability and real-world performance are still to be established.

What changed

• The gateway receives encrypted OHTTP requests at a /.well-known/ohttp-gateway endpoint, decrypts them, forwards the inner request to the application, and encrypts the response. Cloudflare says it will manage the gateway keys and run the service across its edge network.
• Cloudflare’s existing Privacy Gateway is being renamed OHTTP Relay. Developers can pair Cloudflare’s new gateway with an independent relay, or use Cloudflare’s relay with a gateway they operate themselves. Running both hops with Cloudflare would defeat the intended separation of trust; Cloudflare says its gateway will reject requests arriving from its Workers or proxied hosts.
• The gateway is in closed beta with a waitlist. Cloudflare says it plans to offer it as a paid zone add-on this fall. It has not published independent latency or adoption results.

Why it matters

OHTTP separates what the two operators can observe: a relay sees client network identifiers but not the encrypted request, while the gateway sees the request after decryption but receives it from the relay rather than directly from the client. A managed gateway may remove one operational hurdle for privacy-sensitive services already using Cloudflare. The privacy boundary still depends on an independent, non-colluding relay, and application data such as login identifiers or cookies can reveal a user even when their IP address is hidden.

Builder takeaway

Map which organization runs each hop before evaluating the beta. Check how clients obtain gateway keys, how the gateway authenticates the relay, and whether application payloads undermine the intended anonymity. Then measure latency, reliability, and data exposure in your own workflow before treating the design as production-ready.