Cloudflare has finished the other half of a privacy product it started in 2022. In Announcing Cloudflare OHTTP Gateway, the company opens a closed beta of a managed gateway for Oblivious HTTP, the IETF standard that lets “app backends receive HTTP requests without seeing user IP addresses.” OHTTP splits each request across two independently operated hops: a relay that sees the client’s IP and TLS fingerprint but only ciphertext, and a gateway that decrypts the request for the app server but never sees who sent it. “The separation of trust between relay and gateway is critical: it ensures that no single party sees both client identifiers and request contents.”
There are no adoption figures, only named customers and one honest constraint. Flo Health uses OHTTP for its app’s Anonymous Mode, and Apple’s Private Cloud Compute uses it “to disassociate AI inference requests from user identities.” The constraint is the reason the new product exists: customers whose servers already sit behind Cloudflare could not use Cloudflare’s relay, because “Cloudflare would see both client metadata and the decrypted contents of requests, breaking OHTTP’s privacy model.” So the 2022 product is renamed Cloudflare OHTTP Relay, and the new gateway pairs with a third-party relay instead. It is a paid add-on enabled per zone, answering at a well-known path, /.well-known/ohttp-gateway, with chunked OHTTP recommended so requests can be processed incrementally. Non-OHTTP traffic passes through untouched.
The catalog holds the zone surface this attaches to. The Cloudflare provider page lists 650 API pages, and a per-zone add-on is configured through the Cloudflare Zones API and the Cloudflare Zone Settings API. The agentic access profile maps 3,118 operations, 1,576 of them acting. On the Agent Readiness score, sixteen dimensions are lit.
The Kin Score is 81.3, exemplar band, and Agent Readiness is 74.8, agent-native, still the highest this series has recorded. The design lesson travels beyond privacy. Cloudflare noticed that its own product could not be used by its own customers without breaking the trust model, and fixed it by building the piece it should not operate alongside the piece it does, then letting the customer choose which side Cloudflare sits on. That is the same separation an agent platform needs between the party that knows who the user is and the party that executes the request. On this record the unlit dimension is still consent identity. Cloudflare has made it possible for an app not to know who is asking. The record has yet to show the matching contract for an agent proving whose behalf it is asking on.