Cloudflare is launching the Cloudflare OHTTP Gateway as a paid add-on, enabling customers to receive OHTTP traffic with a few clicks. Oblivious HTTP (OHTTP) is an IETF standard enabling app backends to receive HTTP requests without seeing user IP addresses.
OHTTP requests travel through two hops: a relay (hides client identifiers) and a gateway (handles HPKE cryptography). The separation of trust ensures no single party sees both client identifiers and request contents.
In 2022, Cloudflare launched Privacy Gateway (now renamed Cloudflare OHTTP Relay). Customers protecting servers behind Cloudflare couldn’t use a Cloudflare-operated relay — they needed a gateway. Flo Health uses OHTTP for Anonymous Mode; Apple’s Private Cloud Compute uses OHTTP to disassociate AI inference requests from user identities.
The new OHTTP Gateway runs on Cloudflare’s global edge network. Customers can enable it on their zone at https://your-zone.com/.well-known/ohttp-gateway. Cloudflare Access authenticates relays before decryption. The Gateway refuses requests from Cloudflare Workers or proxied hosts to preserve separation of trust.
Cloudflare is renaming “Privacy Gateway” to “Cloudflare OHTTP Relay” to distinguish the two products.