---
title: "Announcing Cloudflare OHTTP Gateway – expanding access to Cloudflare’s privacy-preserving infrastructure"
description: "Cloudflare announced the closed beta of its OHTTP Gateway, a managed service that decapsulates encrypted OHTTP requests for application servers while preserving client privacy and expanding access to privacy-preserving infrastructure. OHTTP is an IETF standard that uses two independent hops—a relay and a gateway—to hide client IP addresses and TLS fingerprints from app servers, ensuring no single party sees both client identifiers and request contents. The new Gateway is designed for customers whose app servers are already behind Cloudflare, allowing them to use a third-party relay while Cloudflare handles the cryptographic work, for example with Apple’s LiveCallerID. Cloudflare also renamed its existing Privacy Gateway product to Cloudflare OHTTP Relay to better distinguish the two product options. The Gateway runs on Cloudflare’s global edge network to minimize latency, and developers can implement OHTTP clients using sample libraries while joining a waitlist for the paid add-on."
---

# Announcing Cloudflare OHTTP Gateway – expanding access to Cloudflare’s privacy-preserving infrastructure

[Cloudflare](https://yomu.fyi/company/cloudflare) · Akshat Mahajan · Oct 2, 2026

**Type:** Announcement

## Summary

Cloudflare announced the closed beta of its OHTTP Gateway, a managed service that decapsulates encrypted OHTTP requests for application servers while preserving client privacy and expanding access to privacy-preserving infrastructure. OHTTP is an IETF standard that uses two independent hops—a relay and a gateway—to hide client IP addresses and TLS fingerprints from app servers, ensuring no single party sees both client identifiers and request contents. The new Gateway is designed for customers whose app servers are already behind Cloudflare, allowing them to use a third-party relay while Cloudflare handles the cryptographic work, for example with Apple’s LiveCallerID. Cloudflare also renamed its existing Privacy Gateway product to Cloudflare OHTTP Relay to better distinguish the two product options. The Gateway runs on Cloudflare’s global edge network to minimize latency, and developers can implement OHTTP clients using sample libraries while joining a waitlist for the paid add-on.

## Context

App servers typically see client IP addresses and TLS fingerprints, which can be used to link requests to users. Cloudflare previously offered an OHTTP Relay (Privacy Gateway) but customers whose servers are behind Cloudflare could not use it because Cloudflare would then see both client metadata and decrypted content, breaking OHTTP’s privacy model. A separate gateway operated by a different party is needed.

## Approach / What changed

Cloudflare built a managed OHTTP Gateway that runs on its global edge network using anycast to minimize latency. The Gateway handles decapsulation of encrypted OHTTP requests and encapsulation of responses, allowing app servers behind Cloudflare to receive OHTTP traffic without seeing client identifiers. It is offered as a paid add-on in closed beta.

## Takeaways

- OHTTP uses two independent hops (relay and gateway) to separate client identifiers from request contents, ensuring no single party sees both.
- Cloudflare’s OHTTP Gateway is for customers whose app servers are behind Cloudflare, allowing them to use a third-party relay while Cloudflare handles decryption.
- The Gateway runs on Cloudflare’s global edge network to minimize latency; customers must implement an OHTTP client and bring their own relay.

## FAQ

### How does OHTTP differ from a basic forwarding proxy?

OHTTP encrypts requests and responses using Hybrid Public Key Encryption (HPKE) so that only the client and app server see plaintext. The relay sees only ciphertext, unlike a basic forwarding proxy that sees everything.

### When should I use the OHTTP Gateway instead of the OHTTP Relay?

Use the Gateway if your app servers are behind Cloudflare or if you want a managed gateway to minimize latency and operational overhead. Use the Relay if your servers are off Cloudflare and you can run your own gateway.

### What do I need to do to get started with the OHTTP Gateway?

Register for the waitlist, implement an OHTTP client using sample libraries, bring your own relay, and avoid sending identifying information in the request body. Use the pvcli client for testing.

**Tags:** [Cloudflare](https://yomu.fyi/topic/cloudflare), [OHTTP](https://yomu.fyi/topic/ohttp), [Privacy](https://yomu.fyi/topic/privacy)

- Source: [Cloudflare](https://blog.cloudflare.com/announcing-cloudflare-ohttp-gateway)
- Source URL: https://blog.cloudflare.com/announcing-cloudflare-ohttp-gateway
- Ingested by Yomu: 2026-10-02T15:00:13.487Z

[Read original post](https://blog.cloudflare.com/announcing-cloudflare-ohttp-gateway)