Secure all your internal vibe-coded applications — in one click

Blog AICloudflare AccessCloudflare Workers** +5 Show 5 more tags

** 8 Tags Show 8 tags

_**

• Selected Tags

• AICloudflare AccessCloudflare WorkersDeveloper PlatformDevelopersProduct NewsSASEZero Trust

• All tags

• Matching tags

• No tags found

• 1.1.1.1

• 2FA

• Abuse

• Access

• Access Control Lists (ACLs)

• Accessibility

• Account Takeover

• Acquisitions

• Addressing

• Advanced Certificate Manager

• Advanced DDoS

• Advertising

• Aegis

• AEO

• Africa

• Afroflare

• Agent Cloud

• Agent Development Lifecycle

• Agent Readiness

• Agents

• Agents Week

• Agents Week 2026

• AI

• AI Bots

• AI Gateway

• AI Search

• AI-SPM

• AI WAF

• AI Week

• Alertmanager

• Always Online

• AMD

• AMP

• Analytics

• Anonymous

• Anti Malware

• Anycast

• API

• API Gateway

• API Security

• API Shield

• APJC

• Apple

• Application Security

• Application Services

• Area 1 Security

• Argo Smart Routing

• ASCII

• Asia

• Athenian Project

• Atlassian

• Attacks

• Audit Logs

• Austin

• Australia

• Authentication

• Authy

• Automatic HTTPS

• Automatic Platform Optimization

• Automation

• AutoMinify

• Auto Rag

• Awards

• AWS

• Baidu

• Bandwidth Alliance

• Bandwidth Costs

• Best Practices

• Beta

• Better Internet

• BGP

• Billing

• Birthday Week

• Blackbird

• Black Friday

• Bot Fight Mode

• Bot Management

• Botnet

• Bots

• BPF

• Brand

• Brand Protection

• Brazil

• Browser Insights

• Browser Rendering

• Browser Run

• Bug Bounty

• Bugs

• BYOIP

• Cache

• Cache Purge

• Cache Reserve

• Cache Rules

• California

• Canada

• Cap'n Proto

• CAPTCHA

• Careers

• CASB

• Categories

• CDN

• CDNJS

• Certificate Authority

• Certificate Pinning

• Certificate Transparency

• Certification

• CFSSL

• Challenge Page

• ChatGPT

• China

• China Network

• Christmas

• Chrome

• CIO Week

• CISA

• Claire

• CLI

• ClickHouse

• Clientless

• Clientless Web Isolation

• Cloud Connector

• Cloud Email Security

• Cloudflare Access

• Cloudflare Apps

• Cloudflare Area 1

• Cloudflare Calls

• Cloudflare Email Service

• Cloudflare for Campaigns

• Cloudflare for SaaS

• Cloudflare for Startups

• Cloudflare Gateway

• Cloudflare History

• Cloudflare Images

• Cloudflare Media Platform

• Cloudflare Meetups

• Cloudflare Network

• Cloudflare One

• Cloudflare One Client

• Cloudflare One User Risk Score

• Cloudflare One Week

• Cloudflare OS

• Cloudflare Pages

• Cloudflare Polish

• Cloudflare Queues

• Cloudflare Realtime

• Cloudflare Stream

• Cloudflare Tunnel

• Cloudflare TV

• Cloudflare Workers

• Cloudflare Workers KV

• Cloudflare Workers KV (ES)

• Cloudflare Workers (PT)

• Cloudflare Zero Trust

• Cloudforce One

• Cloudy

• Code Orange

• Coinbase

• Colombia

• Community

• Compliance

• Compression

• Config Rules

• Configuration Management

• Congestion Control

• Connectivity

• Connectivity Cloud

• Consumer Services

• Containers

• Content Independence Day

• Content Scanning

• Context

• Core

• COVID-19

• Crawler Hints

• CrowdStrike

• Cryptography

• Crypto Week

• CSAM Reporting

• Customers

• Customer Success

• Customer Zero

• CVE

• CVE-2023-50387

• Cyber Readiness

• Cybersecurity

• D1

• Dashboard

• Data

• Database

• Data Catalog

• Data Center

• Data Localization

• Data Localization Suite

• Data Loss

• Data Loss Prevention

• Data Platform

• Data Privacy Day

• Data Protection

• Data Sovereignty

• Data Transfer Bucket

• DDoS

• DDoS Alerts

• DDoS Reports

• Debugging

• Deep Dive

• Descaler

• Design

• Deskope

• Developer Documentation

• Developer Platform

• Developers

• Developer Spotlight

• Developers Storage

• Developer Week

• Device Security

• DevOps

• DEX

• Digital Experience Monitoring

• Digital Forensics

• Disrupt

• Distributed

• Distributed Systems

• Distributed Web

• Diversity

• DLP

• DMARC

• DNS

• DNS Filtering

• DNS Flood

• DNSSEC

• DNS Security

• Dogfooding

• DoH

• Domain Rankings

• Domain Scoped Roles

• dosd

• Drupal

• Due Process

• Durable Execution

• Durable Objects

• Early Hints

• Earth Day

• eBPF

• EC2

• eCommerce

• Edge

• Edge Computing

• Edge Database

• Edge Rules

• Education

• Egress

• Elastic

• Elections

• Election Security

• Elliptic Curves

• Email

• Email Routing

• Email Security

• Email Workers

• EmDash

• Emissions

• Employee Resource Groups

• Encrypted SNI

• Encryption

• Engineering

• Enterprise

• Entropy

• EPYC

• Ethereum

• Europe

• European Union

• Events

• Exploit

• Facebook

• Fancy Bear

• Fast Fonts

• FCC

• Feature Flags

• FedRAMP

• FedRAMP High

• FedRAMP Moderate

• Firefox

• Firewall

• Firmware

• Florida

• Football

• Formal Methods

• Forrester

• Fortran

• Foundation DNS

• Founders' Letter

• France

• Fraud

• Free

• Freedom of Speech

• Front End

• Full Stack

• Full Stack Week

• Fun

• Gartner

• Gatebot

• GA Week

• GDPR

• General Availability

• Generative AI

• Gen X

• Geo Key Manager

• Germany

• GitHub

• Go

• Google

• Google Analytics

• Google Cloud

• Google Workspace

• Government Innovation

• Grace Hopper

• Grafana

• GraphQL

• Green

• Grinch

• Growth

• gRPC

• Guest Post

• Hackathon

• Halloween

• Hardware

• HashiCorp

• Hertzbleed

• Heuristics

• History

• Holidays

• Holocaust

• Hong Kong

• Hosting Con

• Hostnames

• HTTP2

• HTTP3

• HTTPS

• Human Rights

• Hurricane

• Hybrid Cloud

• Hyperdrive

• IBM

• ICANN

• iCloud Private Relay

• Identity

• IETF

• IETF Standards

• IL4

• Image Optimization

• Image Recognition

• Image Resizing

• Image Storage

• Impact

• Impact Week

• I'm Under Attack Mode

• Incident Report

• Incident Response

• India

• Indicators of Compromise

• Indonesian

• Inference

• Infrastructure

• Infrastructure as Code

• Insights

• Intel

• Interconnection

• Internal DNS

• Internet Performance

• Internet Quality

• Internet Regulation

• Internet Shutdown

• Internet Summit

• Internet Traffic

• Internet Trends

• Internship Experience

• Intrusion Detection

• Investors

• IoCs

• iOS

• IoT

• IPFS

• IPsec

• IPv4

• IPv6

• IRAP

• Israel

• Italy

• IWD

• JAMstack

• Japan

• JavaScript

• Jengo

• Jengo Policy

• Joomla

• Judeoflare

• Kafka

• Kernel

• Keyless SSL

• KeyTrap

• Key Value

• Killnet

• Korea

• Kubernetes

• LangChain

• Latency

• Latin America

• Latinflare

• LavaRand

• Lazarus group

• Leaked Credential Checks

• Legal

• Legal Patents Sable

• LGBTQIA+

• Life at Cloudflare

• Linux

• Lisbon

• Live Streaming

• Llama

• LLM

• Load Balancing

• Localization

• Log4J

• Log4Shell

• Logging

• Log Push

• Logs

• LUA

• Machine Learning

• Magecart

• Magic Firewall

• Magic Network Monitoring

• Magic Transit

• Magic WAN

• Magic WAN Connector

• Malicious JavaScript

• Malware

• Managed Components

• Managed Rules

• March of Cloudflare

• MASQUE

• MCP

• Meerkat

• MeetUp

• Meris

• Message Protocol

• Mexico

• Micro-frontends

• Microsoft

• Microsoft 365

• Microsoft Azure

• Middle East

• Migration Hub

• Milestones

• Miniflare

• Mirage

• Mirai

• Mitel

• Mitigation

• Mixed Content Errors

• MLops

• Mobile

• Mobile SDK

• Model Context Protocol

• Moldova

• Monitoring

• Multi-Cloud

• Multi-User

• MySQL

• NaaS

• Net Neutrality

• Network

• Networking

• Network Interconnect

• Network Performance Update

• Network Protection

• Network Services

• New Year

• NGINX

• Ninjas

• NIST

• Node.js

• North America

• Notebooks

• Notifications

• NSEC3

• OAuth

• Observability

• Oceania

• OCSP

• Offices

• Okta

• Olympics

• Onboarding

• OpenAI

• Open API

• OpenBMC

• OpenDNS

• Open Source

• OpenSSL

• OpenTelemetry

• Optimization

• Origin Rules

• Outage

• Oxy

• Pacific Northwest

• Page Rules

• Page Shield

• Parallels

• Partners

• Partnership

• Password-reuse

• Passwords

• Passwords (PT)

• Patents

• PAYGO

• Payments

• Pay Per Crawl

• PCI Certified

• Peering

• Performance

• Phishing

• php

• Phython

• Pingora

• Pipelines

• PlanetScale

• Plans

• Platform Engineering

• Platform Week

• Plesk

• Policy & Legal

• Politics

• Portugal

• Postgres

• Post Mortem

• Post-Quantum

• Precursor

• Prepared Statements

• Prisma

• Privacy

• Privacy Pass

• Privacy Week

• Private IP

• Private Network

• Product Design

• Product News

• Programming

• Programming (PT)

• Project Fair Shot

• Project Galileo

• Project Honey Pot

• Project Pangea

• Project Safekeeping

• Project Turpentine

• Prometheus

• Protocols

• Proudflare

• Proxying

• Public Sector

• Python

• Python Workers

• Quantization

• Queues

• QUIC

• QUICHE

• Quicksilver

• R2

• R2 Super Slurper

• Radar

• Radar Alerts

• Radar API

• Radar Maps

• Railgun

• Randomness

• Ransom Attacks

• Rapid Reset

• Raspberry Pi

• Rate Limiting

• RC4

• RDDoS

• React

• Reading List

• Real-time

• Recruiting

• Regional Services

• Registrar

• Reliability

• Remote Browser Isolation

• Remote Desktop Protocol

• Remote Work

• Replication

• Research

• Resolver

• Restreaming

• Retreat

• Reverse Engineering

• REvil

• Risk Management

• Road to Zero Trust

• Rocket Loader

• RocksDB

• Routing

• Routing Security

• RPC

• RPKI

• RRDNS

• RSA

• Russia

• Rust

• Rust Workers

• SaaS

• SAAS Security

• Sable

• Salt

• Sampling

• Sandbox

• SASE

• Save The Web

• SDK

• Search Engine

• Secrets Store

• Secure Web Gateway

• Security

• Security Analytics

• Security Center

• Security Posture

• Security Posture Management

• Security Service Edge

• security.txt

• Security Week

• SEO

• Serverless

• Serverless AI

• Serverless (PT)

• Serverless Week

• Server Push

• Servers

• SIEM

• Signed Exchanges (SXG)

• SIM

• Singapore

• Single Sign On (SSO)

• Smart Placement

• Smart Shield

• Snippets

• SOC as a Service

• South Africa

• South America

• Spain

• spdy

• Spectrum

• Speed

• Speed Brain

• Speed & Reliability

• Speed Week

• Spoofing

• Sports

• SQL

• SRE

• SSE

• SSH

• SSL

• Standards

• Startup Enterprise Plan

• Statistics

• StopTheHacker

• Storage

• Sumo Logic

• Super Bowl

• Supercloud

• Supply Chain Attacks

• Support

• Sustainability

• SWAG

• SWG

• Swift

• Switzerland

• SXSW

• SYN

• SYN Flood

• Syria

• TCP

• Team

• Teams Dashboard

• TechCrunch

• Technical Writing

• Tech Talks

• Terraform

• Testimonials

• Testing

• Texas

• Thanksgiving

• The Serverlist Newsletter

• Threat Data

• Threat Feeds

• Threat Intelligence

• Threat Operations

• Threat Report

• Threats

• Tiered Cache

• TikTok

• TLS

• TLS 1.3

• Tools

• Tor

• Tracing

• Traffic

• Transform Rules

• Transparency

• Trends

• Trust & Safety

• TTFB

• TTL

• TURN

• TURN Server

• Turnstile

• TypeScript

• UDP

• Ukraine

• United Kingdom

• Universal SSL

• URL Scanner

• USA

• User Research

• VDI

• Vectorize

• Vetflare

• Video

• Visibility

• Vite

• VoIP

• VPC

• VPN

• Vulnerabilities

• WAF

• WAF Attack Score

• WAF Rules

• Waiting Room

• WARP

• WARP Connector

• WASM

• Web3

• Web Application Firewall

• WebAssembly

• Web Asset Discovery

• Webinars

• WebMCP

• WebP

• WebRTC

• WebSockets

• Wildebeest

• Womenflare

• WordPress

• Workers AI

• Workers Launchpad

• Workers Logs

• Workers Observability

• Workers Sites

• Workers Unbound

• Workers VPC

• Workflows

• World IPv6 Day

• Wrangler

• x402

• Year in Review

• Z3

• Zaraz

• Zero Day Threats

• Zero Trust

• Zero Trust Week

• Zone Versioning

Developer PlatformDevelopersProduct NewsSASEZero Trust

AICloudflare AccessCloudflare WorkersDeveloper PlatformDevelopersProduct NewsSASEZero Trust

August 14, 2026

Secure all your internal vibe-coded applications — in one click

**Chythra Malapati ,   **Matt Rothenberg ,  and  **Matt Provost

7 minute read

** COPY URL

AI has enabled employees across every team to build applications faster than ever before.

But that speed is also what's keeping every CISO up at night: any employee can build an application, deploy it to the public Internet, and accidentally expose internal work or company data.

Today, we're launching new tools to make it easy to keep your applications hosted on Workers private. You can now apply Cloudflare Access directly to a Worker or to every Worker in your account, so that your applications are behind your company login by default, without relying on each developer to set that up themselves.

You can now:

• **Set a policy at the account level **to ensure that all preview and production deployments are behind your company login by default.

• Set a policy on a single application to ensure authentication is enforced on every domain associated with it, no matter how it's deployed.

• See exactly who visits your application. Get every authenticated user’s email, name, and groups directly in your code — no JWT (JSON Web Token) validation required. 

• **Deploy an internal platform where every deployment is private by default. **We've open-sourced an example: an internal static site platform where every Worker deployed is private.

Access on Workers: how it works

When you enable Access on a Worker, Cloudflare enforces authentication before any request reaches your application code. It doesn't matter how the request gets to your Worker, whether it's through a custom domain, a route, a workers.dev subdomain, or a preview URL. If Access is on, the user has to authenticate first.

Previously, you had to configure this at the hostname level, which meant setting up Access policies on each domain your Worker was reachable on. If you wanted to add a new custom domain to your Worker, you needed to update the Access policy first or that hostname would be reachable without authentication. Now the policy is attached to the Worker itself, so any domain or URL associated with that Worker is automatically protected. You can choose what to protect: just preview URLs, or all hostnames. 

If you set it to previews only, every preview URL created for that application, whether it's a workers.dev preview URL or a custom domain you use for previews, will require authentication whenever you deploy a new version. If you set it to all hostnames, every domain associated with that Worker is protected — custom domains, routes, workers.dev subdomains, and preview URLs.

Access gives you control over how users authenticate. You can connect your existing identity provider, so employees sign in with the credentials they already use, or restrict access to specific email addresses, email domains, or groups. For agents, you can grant access through service tokens.

Read more in the Cloudflare Access for Workers documentation here.

Keep every Worker in your account private by default

If you have developers across your organization deploying Workers, you don't want to rely on each one to remember to enable Access. You want the default to be private.

You can set an Access policy once at the account level, and every Worker in your account, current and future, is private from the moment it's created.

You choose what the policy covers: only preview URL traffic, all production traffic, or both. Preview-only is useful if your production Workers are intentionally public, but you never want an in-progress deployment exposed.

Need a Worker to be public? Bypass the account-wide policy on that one Worker.

Protect a specific Worker

If you don't need an account-wide default and just want to lock down one specific Worker, you can apply Access to that Worker directly.

The new Access tab in the Worker view shows exactly which policies apply to that application. If you have multiple, the most specific one takes priority: hostname policies first, then Worker policies, then account policies.

See who is accessing your application

When Access is protecting your Worker, you can get information about who is making each request — their email, name, and groups — so you can personalize what they see, enforce permissions, or log activity per user.

This works through yourWorker's context object (ctx). Every request to your Worker carries a ctx with metadata about that request. When Access is enabled, we attach the authenticated user's identity to it as ctx.access. From there, call ctx.access.getIdentity() to get back the user's email, name, and more.

Before, this meant validating a JWT yourself — parsing the token, verifying the signature, and extracting the claims. Now, when Access is enabled on your Worker, every authenticated request includes ctx.access.

Here's all you need to get the user's identity:

export default {
  async fetch(request, env, ctx) {
    if (!ctx.access) {
      return new Response("Access required", { status: 403 });
    }

    const identity = await ctx.access.getIdentity();
    const email = identity?.email ?? "unknown";

    return new Response(`Hello, ${email}`);
  }
};

**

Test locally before you deploy

We showed how you can use ctx.access.getIdentity() to give your Worker information about who is making a request — their email, name, and groups. 

You can use this when developing locally with wrangler dev. Add an access block to your wrangler.jsonc to simulate an authenticated user:

{
  "access": {
    "dev": {
      "aud": "my-app",
      "identity": { "email": "admin@company.com" }
    }
  }
}

**

Your Worker picks it up through ctx.access.getIdentity() — returning an identity object shaped like what you'd get in production. Swap the email in your config to test as a different user.

This means you can verify that the right content shows up for the right user without having to deploy and sign in through Access every time you make a change.

Deploy an internal platform where every application is private by default

If you manage an internal platform where employees can prototype and deploy applications, you need every application to be private without configuring access controls on each one.

Workers for Platforms lets you deploy Workers at scale. Every Worker lives inside a namespace, and all traffic to that namespace goes through a single entry point: the dispatch Worker.

Set an Access policy on your dispatch Worker, and every Worker deployed through it is private by default.

We also have an open-source example where you can deploy your own internal drag-and-drop deployment platform — configure access on the dispatcher worker once and every site deployed through it is private by default.

Click the button below to deploy it yourself!

For the full architecture, see our Workers for Platforms reference architecture.

Built on solid foundations

This feature was made possible by FL2, the new Rust-based modular proxy that powers Cloudflare's edge. Access is the front gate to your applications, and as such, it traditionally ran before all Workers logic in the request pipeline. But in order for Access applications to target individual Workers themselves instead of their hostnames, Access needs to know which Worker a given request is destined to reach. Therefore, we needed to split Workers routing from Workers execution, and move the routing logic, so it could run before Access.

In our old FL1 system based on NGINX and modules written in Lua, this change would have been complex and risky. Interactions between products can be subtle, and moving logic to an earlier phase of the request pipeline can be unsafe if it depends on shared state that is modified by another product.

FL2 made it easy. Its strict module system separates logic into well-defined, consistently ordered phases that statically declare their inputs and outputs. We were able to lean on the compiler to surface any broken interactions between phases, and gradually roll out this refactor with confidence.

Try it today

This is now available to everyone. Try it out in the dashboard or read the Cloudflare Access for Workers documentation to get started.

Acknowledgments

Thank you to Jesse Li, Brandon Strittmatter, Kyle Hiller, Kenny Johnson, Matt "TK" Taylor, Brendan Irvine-Broque, Yomna Shousha, and Mike Aizatsky for the engineering and design work that made this possible!

**

**

On this page

Discuss Online

**

Related tags

AICloudflare AccessCloudflare WorkersDeveloper PlatformDevelopersProduct NewsSASEZero Trust

Follow on Social Media

• **Cloudflare

• **Chythra Malapati

• **Matt Rothenberg

• **Matt Provost

Subscribe to receive notifications of new posts

Email address _

We’ll never share your email address.

**Subscribe

Thanks for subscribing! Check your inbox to confirm.