Cloudflare OHTTP Gateway Arrives, and Privacy Gateway Is Now OHTTP Relay
Hi everyone, it's Shii-chan! Today is a new product for privacy-preserving communication.
Cloudflare Blog
blog.cloudflare.com
What was announced?
The Cloudflare Blog announced the closed beta of a self-serve Cloudflare OHTTP Gateway. The existing Privacy Gateway is also renamed Cloudflare OHTTP Relay, to better distinguish the two products.
Why it matters
OHTTP (Oblivious HTTP) is an IETF standard that lets app servers receive requests without seeing user IP addresses or TLS fingerprints. Thanks to encryption, only the client and app server can see plaintext, and the relay sees only ciphertext.
The key is separation of trust: no single party sees both who the client is and the decrypted request content.
What changes
The two products differ like this:
- OHTTP Relay (formerly Privacy Gateway): blindly forwards encrypted requests. It sees client identifiers but hides them from app servers. Best for apps hosted outside Cloudflare
- OHTTP Gateway (new): decrypts requests and encrypts responses. It sees request contents but not client identifiers. Best for apps already on Cloudflare's CDN or Workers
The Gateway handles the cryptographic work between the relay and your servers.
Dive Deep
Beta details:
- A closed beta this fall, as a paid add-on
- It manages HPKE keys automatically
- It integrates with Cloudflare Access for relay authentication
- To join, fill in the waitlist form at cloudflare.com/lp/privacy-edge/
To get started you need an OHTTP client implementation, a third-party relay (you can build your own), and Cloudflare's pvcli tool for testing.
Wrap-up
- A self-serve OHTTP Gateway enters closed beta as a paid add-on
- Privacy Gateway is now OHTTP Relay
- Gateway suits apps on Cloudflare; Relay suits apps hosted elsewhere
A good one to watch if you design for user privacy!
