Cloudflare’s OHTTP gateway separates request contents from client identity

Cloudflare has opened a closed beta for an Oblivious HTTP gateway, with a waitlist for the paid add-on. Encrypted requests pass through an independently operated relay before the gateway decrypts them, separating client identity from request contents. Apps behind Cloudflare need a third-party relay to preserve that split. It is a privacy architecture to evaluate, not an ordinary proxy you can simply enable everywhere.

Cloudflare · Oct 2, 2026

Why it matters

The design makes the trust boundary explicit for privacy-sensitive application backends.

More context

Watch access availability and assess relay operation before adopting it. Cloudflare also renamed its earlier Privacy Gateway product to OHTTP Relay; the relay and gateway have different roles.

Keep in mind

The privacy property depends on independent operation of the two hops and correct application integration.

Original read