Cloudflare opens a beta of a managed Oblivious HTTP gateway and renames its relay
Victoria Shinder2 min readCloudflare has opened a closed beta of a managed Oblivious HTTP gateway, which it describes in a blog post as a paid add-on that customers will be able to enable on a zone with a few clicks this autumn; a waitlist form is open.
What OHTTP does. Oblivious HTTP is an IETF standard that lets an app backend receive HTTP requests without seeing the user's IP address. Requests pass through two independently operated hops. A relay forwards encrypted requests blindly, hiding client identifiers such as the IP address or TLS fingerprint. A gateway decrypts the request and encrypts the response so that the app server can handle it as ordinary HTTP. The privacy model depends on the relay and the gateway being run by separate parties that do not collude, so that no one sees both who sent a request and what it says.
Why a gateway now. Cloudflare has run a relay since 2022 under the name Privacy Gateway. The post cites Flo Health's Anonymous Mode and Apple's Private Cloud Compute, which uses OHTTP to separate AI inference requests from user identities, as users of OHTTP. But customers whose servers already sit behind Cloudflare could not use Cloudflare's relay, because Cloudflare would then see both the client metadata and the decrypted request, breaking the model. They had to build and operate their own gateway, which the company says is hard to do securely and quickly.
The two options. The relay is renamed Cloudflare OHTTP Relay and is meant for apps hosted elsewhere that run their own gateway. The new OHTTP Gateway is meant for apps already on Cloudflare's CDN or Workers, for those receiving OHTTP traffic from a third-party relay such as Apple's LiveCallerID, and for teams that want a managed gateway. Cloudflare says the gateway will run on every server in its network, so relay-to-gateway hops stay short, and requests from its CDN can be decrypted and passed to the app on the same machines.
What is not yet known. The post does not give a price or a general availability date beyond "this fall".
What it means
OHTTP's guarantee is organisational as much as cryptographic: it holds only if the two hops are run by different companies. Teams adopting the gateway should therefore decide who runs their relay before anything else, because choosing Cloudflare for both would quietly remove the protection the protocol exists to provide.