Cloudflare's outbound Workers: authenticate your sandbox without ever handing it the token!

Hey there, Shiichan here! Today I want to talk about a clever way to let AI agents talk to the outside world safely — where the agent never gets to hold the credentials at all. How cool is that!

Cloudflare Blog blog.cloudflare.com

What was announced?

Cloudflare's Blog introduced a new building block for Sandboxes called outbound Workers. It is a programmable egress proxy: when code inside a sandbox reaches out to an external service, the whole request routes through a handler you write in JavaScript. That gives you one place to inject credentials, restrict methods, and watch every call. Sandboxes run on top of Containers as disposable, microVM-isolated environments, and outbound Workers slot right in.

The story so far

An agent that calls GitHub or an internal service needs some kind of credential, and every classic approach had a catch:

• Plain API tokens: the easiest, handed over via env vars or secret files — but you have to trust the sandbox not to leak them, and you still manage expiry and rotation.
• Workload identity tokens (like OIDC): you pass an identity attestation instead of raw permissions and exchange it for short-lived access. Safer, but many upstream services do not support OIDC, so you end up writing custom token exchange.
• Custom proxies: the most flexible, but you have to intercept all traffic, build a dynamic proxy, and keep it fast — a lot of work.

The ideal, as I see it, is zero-trust (no tokens for untrusted code), simple to write, identity-aware, observable, fast, transparent, and dynamic, all at once. That is exactly what outbound Workers aim for.

What changes

My favorite part is zero-trust credential injection. With outboundByHost you define a function per domain, so you can add a token only to requests bound for my-internal-vcs.dev — without ever showing that token to the agent. You can even return different tokens per container ID and pull the keys from KV, which is encrypted at rest and in transit.

On top of that, outbound Workers can call Cloudflare bindings directly. Before, a sandbox reaching R2 or KV needed injected credentials and public API calls; now you go through the binding. Namespace your R2 paths by sandbox ID and you get scoped access with no token parsing or policy wiring.

Dive Deep

Here is the fun bit. To rewrite a request you have to decrypt HTTPS, so outbound Workers mint a unique, ephemeral certificate authority (CA) and private key per sandbox instance and place that CA inside the sandbox. The sandbox trusts it by default, which makes this a transparent man-in-the-middle (MITM) proxy that can inspect and edit traffic. For a plain container you opt in with interceptHttps = true and trust the CA via sudo update-ca-certificates. The ephemeral key and CA never leave the sidecar process and are never shared across sidecars.

Controls can be dynamic too. setOutboundHandler swaps the policy at runtime — allow a few hosts only during dependency install, then shut off HTTP entirely, keeping the network-open window tiny. You can even have the agent ask a user to approve an operation and update the policy on the fly.

Under the hood, ctx.container gains interceptOutboundHttp and interceptOutboundHttps, matching by hostname, IP range, or all outbound traffic with simple glob patterns. Swap a handler and even existing TCP connections pick up the new one without dropping. Locally, wrangler dev spins up a sidecar called proxy-everything inside the container's network namespace, applies TPROXY rules, and routes matching traffic to workerd so dev mirrors production.

To start, skim the docs and upgrade to @cloudflare/containers@0.3.0 or @cloudflare/sandbox@0.8.9.

Wrap-up

• outbound Workers are a programmable egress proxy that intercepts a sandbox's outbound traffic with a JavaScript handler.
• outboundByHost injects credentials per domain with zero trust — the agent never sees the token.
• A transparent MITM using an ephemeral CA lets you inspect and rewrite even HTTPS.
• setOutboundHandler swaps policy at runtime, shrinking how long the network stays open.
• You can call bindings like R2 and KV directly and scope them by sandbox ID.

If you run AI agents in sandboxes and sweat over credential handling, this one is for you. Bump the package and give it a try next week!