Recommended Free Tools
Cloudflare’s OHTTP Gateway refuses to decrypt requests sent from Cloudflare Workers or from hosts proxied on Cloudflare. The rule is deliberate: if Cloudflare handled both the relay and gateway roles for the same request, it could potentially see both who sent it and what it contains, defeating OHTTP’s separation of trust.
Cloudflare announced the Gateway on October 2, 2026, as a paid add-on for a Cloudflare zone and opened a closed beta. The announcement offered a waitlist but did not give a public price or general-availability date. Cloudflare also renamed its earlier Privacy Gateway service to Cloudflare OHTTP Relay; Relay and Gateway perform different jobs.
As an Amazon Associate I earn from qualifying purchases.
What OHTTP does—and what it does not do
Oblivious HTTP (OHTTP) is an application-layer protocol for sending HTTP messages through two distinct roles: a relay and a gateway. A client encrypts a request for the gateway, then sends the encrypted message to the relay. The relay forwards the ciphertext; the gateway decrypts it and passes the request to the application. The response travels back encrypted for the client.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThe relay can observe client-side network identifiers, while the gateway and application can see the request content but ordinarily see the relay’s network identity rather than the client’s IP address. The design aims to keep any one party from seeing both who sent the request and what it contains. Cloudflare’s technical explanation of OHTTP describes it as a message proxy for transactional exchanges such as app APIs, not a general-purpose connection proxy like a VPN.
#1 Best Overall
OHTTP protects network-level identity; it does not remove personal information deliberately included in the request itself. If an app puts an email address, username, or other identifier in the inner request, the gateway and application can still read it.
Why Cloudflare rejects requests that arrive through Cloudflare
Cloudflare says its Gateway will refuse to decrypt requests sent from Cloudflare Workers or from hosts proxied on Cloudflare. The concern is not that OHTTP cannot work with a Cloudflare-hosted application. It is that Cloudflare must not act as both trust roles for the same request: the relay could see client metadata, while the Gateway could see the decrypted inner request. Combining those views would undermine the privacy boundary OHTTP is intended to provide.
Cloudflare put the rationale this way in its October 2, 2026 announcement: “So, to preserve OHTTP’s separation of trust and ensure that Cloudflare never sees both client identities and decrypted inner requests, our Gateway will refuse to decrypt requests sent from Cloudflare Workers or from proxied hosts on Cloudflare.”
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The announcement does not specify how the Gateway identifies a request as coming from a Worker or a proxied Cloudflare host, nor does it publish a particular error code. The rejection rule should therefore be understood as a product safeguard, not as evidence of a general inability to decrypt OHTTP traffic.
Choose the pairing that keeps the roles separate
Cloudflare describes two arrangements, depending on where the application runs and which operations the team wants to manage:
| Application and operations | Cloudflare component | Other trust role |
|---|---|---|
| Application hosted behind Cloudflare’s CDN or running on Workers; or a team seeking a managed gateway | Cloudflare OHTTP Gateway | Use a third-party relay. Cloudflare identifies third-party client requests, such as Apple LiveCallerID, as a use case. |
| Application hosted off Cloudflare, with a team able to operate its own gateway | Cloudflare OHTTP Relay | Operate the gateway separately from Cloudflare. |
Do not treat Relay and Gateway as interchangeable services. The key decision is who operates each role and whether the relay is independent of the gateway. Cloudflare’s Relay documentation describes Relay as closed beta and enterprise-only as of October 13, 2026; the Gateway announcement describes its own closed beta. Public pricing and a general-release date were not stated for Gateway in that announcement.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the Gateway handles
Cloudflare says its Gateway handles OHTTP cryptography, forwards the decrypted inner request to the application, and encrypts the response. The launch announcement says it supports standard and chunked OHTTP, recommending chunked OHTTP for incremental processing. It also says customer keys are managed by Cloudflare and exposed at the zone’s /.well-known/ohttp-gateway endpoint.
Protect the request body as well as the network identity
Because OHTTP does not scrub content, developers should avoid placing user identifiers in the inner request unless the application needs them. Cloudflare’s Relay setup guide recommends removing names, email addresses, and phone numbers where possible, and reviewing crash reporting for sensitive information.
Cloudflare’s Relay documentation also describes what each Relay participant can observe: Relay can see the connecting device’s IP address and request metadata such as browser, operating system, hardware configuration, and timestamp, but not the encrypted application request content. Relay customers can see application request content and the Relay server’s IP address and associated metadata. Cloudflare says Relay logs are retained for approximately 124 days, described as the most recent quarter plus one month. These statements concern Relay and should not be assumed to describe Gateway logging.
The same Relay documentation notes that content-based WAF rules, application-content caching, and API Shield schema validation or discovery are incompatible with Relay because those features need request content or URLs that Relay cannot see. That compatibility guidance is specific to Relay; it does not establish equivalent behavior for Gateway.
Quick Recap
Official Cloudflare references
- Cloudflare OHTTP Gateway announcement, October 2, 2026
- Cloudflare OHTTP Relay overview
- Cloudflare OHTTP Relay documentation
- Cloudflare OHTTP Relay setup guide
- Cloudflare OHTTP Relay compatibility documentation
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
