{"slug": "cloudflare-access", "name": "Cloudflare Access", "category": "networking", "category_name": "Networking and VPN", "description": "", "recommenders": 3, "commenters": 6, "warners": 1, "score": 2.272, "rising": 0.35, "first": "2026-02-25", "latest": "2026-09-18", "why": "I recommend switching to Cloudflare Access with the provided instructions for additional security.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 1, "compare": 1, "warn": 1}, "spark": [0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "I recommend switching to Cloudflare Access with the provided instructions for additional security.", "kind": "", "icon": true, "domain": null, "github_repo": null, "official_url": "https://www.cloudflare.com/zero-trust/products/access/", "pricing": "", "aliases": ["Cloudflare Access"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 796161730, "item_id": 49760108, "url": "https://news.ycombinator.com/item?id=49760108", "by": "dalberto", "date": "2026-09-18", "stance": "recommend", "quote": "I also use CF managed auth to make auth easier.", "excerpt": "I built something for this exact use-case using Cloudflare Tunnels: https://github.com/dalberto/mcp-ferry I also use CF managed auth to make auth easier.", "context": "", "use_case": "", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 782726228, "item_id": 48920389, "url": "https://news.ycombinator.com/item?id=48920389", "by": "ddyy", "date": "2026-07-15", "stance": "recommend", "quote": "I recommend switching to Cloudflare Access with the provided instructions for additional security.", "excerpt": "Hi HN, The invoicing SaaS I was using to bill my clients raised its credit card processing fee to 6.9% for free accounts (4% on top of Stripe's 2.9% + 30c fee), so I decided to build my own to fit my minimal needs, hence I called it Minvoice. It runs on Cloudflare Workers + D1 for DB, it should easily be within their free tier for most use cases. The application is built on Hono server-rendered JSX with no client fra", "context": "", "use_case": "login protection", "switched_from": "", "story": "Show HN: Minvoice \u2013 invoicing app that runs on Cloudflare Workers and D1"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 796124962, "item_id": 49757810, "url": "https://news.ycombinator.com/item?id=49757810", "by": "KomoD", "date": "2026-09-18", "stance": "warn", "quote": "I don't really want to use Cloudflare anymore, and they have some restrictions that don't really work for me, e.g. 100MB max file upload size.", "excerpt": "I don't really want to use Cloudflare anymore, and they have some restrictions that don't really work for me, e.g. 100MB max file upload size. Authelia wasn't too difficult to set up and manage. I expose my services with a Caddy reverse proxy on a VPS, with Authelia in front, and so far it basically just works.", "context": "self-hoster", "use_case": "access control", "switched_from": "", "story": "Ask HN: What self-hosted apps do you use daily?"}]}], "who": [{"by": "nijave", "context": "built PoC for work", "url": "https://news.ycombinator.com/item?id=49543151", "date": "2026-09-02"}], "tags": [], "use_cases": ["access control", "auth injection for llm api", "login protection"], "compared": [{"slug": "authelia", "name": "Authelia", "co": 2, "switched_from": 0, "switched_to": 1}, {"slug": "cloudflare-workers", "name": "Cloudflare Workers", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49746527", "title": "Ask HN: What self-hosted apps do you use daily?", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49754785", "title": "Cloudflare Quick Tunnels", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49538490", "title": "Show HN: FrontierHarness Eval \u2013 9 harness, same model, cost per pass varies 17x", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48920388", "title": "Show HN: Minvoice \u2013 invoicing app that runs on Cloudflare Workers and D1", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47153800", "title": "GPT Bot Ignoring Robots.txt on my cloudflare worker", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {"recommend": 1}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {"recommend": 1}, "2026-08": {}, "2026-09": {"neutral": 1, "compare": 1, "warn": 1, "recommend": 1}, "2026-10": {}}, "quotes": [{"id": 796161730, "item_id": 49760108, "url": "https://news.ycombinator.com/item?id=49760108", "by": "dalberto", "date": "2026-09-18", "stance": "recommend", "quote": "I also use CF managed auth to make auth easier.", "excerpt": "I built something for this exact use-case using Cloudflare Tunnels: https://github.com/dalberto/mcp-ferry I also use CF managed auth to make auth easier.", "context": "", "use_case": "", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 796124962, "item_id": 49757810, "url": "https://news.ycombinator.com/item?id=49757810", "by": "KomoD", "date": "2026-09-18", "stance": "warn", "quote": "I don't really want to use Cloudflare anymore, and they have some restrictions that don't really work for me, e.g. 100MB max file upload size.", "excerpt": "I don't really want to use Cloudflare anymore, and they have some restrictions that don't really work for me, e.g. 100MB max file upload size. Authelia wasn't too difficult to set up and manage. I expose my services with a Caddy reverse proxy on a VPS, with Authelia in front, and so far it basically just works.", "context": "self-hoster", "use_case": "access control", "switched_from": "", "story": "Ask HN: What self-hosted apps do you use daily?"}, {"id": 796059777, "item_id": 49753736, "url": "https://news.ycombinator.com/item?id=49753736", "by": "osr00", "date": "2026-09-18", "stance": "compare", "quote": "why not using Cloudflare Access?", "excerpt": "I used Authelia in the past, I'm curious: why not using Cloudflare Access?", "context": "", "use_case": "access control", "switched_from": "", "story": "Ask HN: What self-hosted apps do you use daily?"}, {"id": 792690418, "item_id": 49543151, "url": "https://news.ycombinator.com/item?id=49543151", "by": "nijave", "date": "2026-09-02", "stance": "neutral", "quote": "it assumes you're using Cloudflare Access (VPN) with a Cloudflare AI Gateway", "excerpt": "I use routatic/proxy (actually my own fork with various changes/fixes http://github.com/nijave/proxy/ -- fyi the fork is all vibes...) Some gateways/proxies/hosts also offer multiple endpoints (z.ai has both Anthropic endpoint and Completions endpoint) Edit: Here's the PoC I made for work although it assumes you're using Cloudflare Access (VPN) with a Cloudflare AI Gateway to hand wave the auth away (auth to the LLM ", "context": "built PoC for work", "use_case": "auth injection for LLM API", "switched_from": "", "story": "Show HN: FrontierHarness Eval \u2013 9 harness, same model, cost per pass varies 17x"}, {"id": 782726228, "item_id": 48920389, "url": "https://news.ycombinator.com/item?id=48920389", "by": "ddyy", "date": "2026-07-15", "stance": "recommend", "quote": "I recommend switching to Cloudflare Access with the provided instructions for additional security.", "excerpt": "Hi HN, The invoicing SaaS I was using to bill my clients raised its credit card processing fee to 6.9% for free accounts (4% on top of Stripe's 2.9% + 30c fee), so I decided to build my own to fit my minimal needs, hence I called it Minvoice. It runs on Cloudflare Workers + D1 for DB, it should easily be within their free tier for most use cases. The application is built on Hono server-rendered JSX with no client fra", "context": "", "use_case": "login protection", "switched_from": "", "story": "Show HN: Minvoice \u2013 invoicing app that runs on Cloudflare Workers and D1"}, {"id": 754609746, "item_id": 47163109, "url": "https://news.ycombinator.com/item?id=47163109", "by": "white_viel", "date": "2026-02-25", "stance": "recommend", "quote": "", "excerpt": ">> interesting. workers.dev domains can be a liability sometimes -- if you've mapped the worker to a real zone, then you probably don't want the workers.dev zone anymore. maybe that is a good idea, prompt a user to disable the worker.dev domain. however, having the worker.dev domain open for me is more of a backup way to access the worker as the mapped domain is more for a hobby project. > Interesting. workers.dev do", "context": "", "use_case": "", "switched_from": "", "story": "GPT Bot Ignoring Robots.txt on my cloudflare worker"}]}