Cloudflare is releasing its Cloudflare OHTTP Gateway, a managed service that performs cryptographic decapsulation for Oblivious HTTP (OHTTP) traffic, the company announced on October 2, 2026.
OHTTP is an IETF standard protocol designed to let application servers receive HTTP requests without learning client identifiers such as IP address or TLS fingerprint. Requests travel through two independent hops: a relay that blindly forwards encrypted traffic, and a gateway that decrypts it and returns encrypted responses. This separation of trust ensures no single party sees both client metadata and request contents.
In a typical client-server exchange, an app server learns the client's IP address, TLS cipher, and other fingerprint data. Cloudflare's blog explains that an OHTTP relay strips these identifiers before forwarding requests, so the app server sees only the relay's location and a generic TLS fingerprint. The company provides a concrete example: instead of a client from Campbell, California with a unique cipher, the server receives a request from a relay in Austin, Texas with a different cipher, breaking the link between the request and the user's identity.
The Gateway uses Hybrid Public Key Encryption (HPKE) to encapsulate requests so that only the client and app server can read them. The relay sees ciphertext, the Gateway sees decrypted request content, and the app server sees plain HTTP. This creates a double-blind privacy model: no party sees both pieces of the same transaction.
Cloudflare positions the Gateway as a solution for developers who already have their app servers behind Cloudflare's CDN or Workers. Previously, customers using Cloudflare's OHTTP Relay (formerly Privacy Gateway) had to bring their own gateway to maintain the required trust separation. Now they can instead use a third-party relay with Cloudflare's managed Gateway. Apple's Private Cloud Compute and LiveCallerID SDK are cited as existing use cases.
The Gateway offers automatic scaling, key management, and abuse protection. Customers configure it by enabling the add-on and having clients send well-formed OHTTP requests to https://your-zone.com/.well-known/ohttp-gateway. The service refuses to decrypt requests from Cloudflare Workers or proxied hosts on Cloudflare, preserving the privacy model by ensuring Cloudflare never sees both client identifiers and decrypted request contents.
Performance depends on using chunked OHTTP for incremental processing, which Cloudflare recommends. The company also built abuse prevention: a client sending requests to example.com may only target subdomains of that zone, not arbitrary domains like wikipedia.com.
For developers wanting to stay on OHTTP, Cloudflare says the Gateway is ready for production use, though customers must still bring their own relay and implement an OHTTP client. The company provides a sample client library and sample relay code to help get started.