# Cloudflare services for private origins is now generally available [Canonical reading](https://escapemeridian.com/readings/cloudflare-services-for-private-origins-is-now-generally-9ff635bb) Cloudflare says its private origins service is now generally available, allowing customers to point a proxied DNS record at a private IP and route requests to the origin over existing Cloudflare One connectivity. The origin stays private, while Cloudflare says services including WAF, caching, bot management, and Workers work as they do for public origins. The change addresses a problem Cloudflare says customers raised: internal APIs, AI agent backends, MCP servers, and operational tools need to receive Internet requests without being built to face the Internet. Cloudflare says earlier approaches could require exposing a public IP, opening a firewall port, or running cloudflared alongside the origin. Access requires a Private Origins entitlement and Cloudflare One connectivity; some features remain unsupported or require Load Balancing. Cloudflare says work is underway on private-to-private traffic, with a closed beta targeted for early 2027. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source Cloudflare Blog · Article Original source date: Oct 30, 2026 (2026-10-30T14:23:43.668Z). Date basis: Date stated by the publisher. Added to Escape Meridian: 2026-11-13T18:33:24.930Z. First observed: 2026-10-30T14:24:36.880Z. Retrieved: 2026-10-30T16:48:35.536Z. - [Cloudflare services for private origins is now generally available](https://blog.cloudflare.com/private-origins-public-to-private/) ## Limits Cloudflare says access requires a Private Origins entitlement, Cloudflare One connectivity, and Unified Routing unless connecting over Cloudflare Tunnel. The source names unsupported features and a requirement for origin health checks, but refers readers to developer documentation for the full list of current limitations. Private-to-private traffic is described as in development, with a closed beta targeted for early 2027; the source does not report results or a release date. ## Open question Which application services or connectivity setups remain unsupported beyond the exclusions Cloudflare lists? ## Source-stated Cloudflare says its private origins service is generally available and routes requests to a private IP over existing Cloudflare One connectivity. > Point a proxied DNS record at a private IP, and Cloudflare reaches the origin over your existing Cloudflare One connection. - [Supporting source](https://blog.cloudflare.com/private-origins-public-to-private/) ## Source-stated Cloudflare says the origin remains private while several application services work as they do for public origins. > Your origin stays private, while web application firewall (WAF), caching, bot management, and Workers work just as they do for public origins. - [Supporting source](https://blog.cloudflare.com/private-origins-public-to-private/) ## Source-stated Cloudflare says customers raised the need to let Internet users reach internal services that were not built to face the Internet. > Their internal APIs, AI agent backends, MCP servers, and operational tools weren’t built to face the Internet, but those services still need to accept requests from partners, customers, or agents over the Internet. - [Supporting source](https://blog.cloudflare.com/private-origins-public-to-private/) ## Source-stated Cloudflare says some features are unsupported, and origin health checks require Load Balancing. > Argo Smart Routing and Dedicated CDN Egress IPs aren’t supported, and origin health checks require Load Balancing. - [Supporting source](https://blog.cloudflare.com/private-origins-public-to-private/) ## Source-stated Cloudflare says it is working on private-to-private traffic and targets a closed beta in early 2027. > Engineering work is underway, and we’re targeting a closed beta in early 2027. - [Supporting source](https://blog.cloudflare.com/private-origins-public-to-private/) ## Source and contributor context Cloudflare · Publisher The publisher is identified here. No individual author has been inferred. ## Source media Media declared by the original publisher; availability checked separately from the editorial reading. - [BLOG-3230 Feature Image · Cloudflare Blog](https://blog.cloudflare.com/_image?href=https%3A%2F%2Fblog.cloudflare.com%2F_emdash%2Fapi%2Fmedia%2Ffile%2F01KW44TXMXRJ1NFA38CJB0MT3A.png&w=1280&h=720&f=webp&fit=cover&position=center) ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## API An application programming interface: a defined way for software to request data or actions from another system. - [Definition reference](https://developer.mozilla.org/en-US/docs/Glossary/API) ## AI agent An AI system that chooses and carries out actions toward a goal, often using software tools. - [Definition reference](https://www.ibm.com/think/topics/ai-agents) ## Cloudflare Cloudflare provides networking, security and computing services that help run websites and applications. - [Explore this context](/entities/cloudflare) - [Reference](https://blog.cloudflare.com/) ## Editorial provenance Version 1. Publication ID: d4c5fc2d-06f7-4bd6-8804-9420a072e969. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-13T18:33:24.930Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 9211edbf8a1eee5c122206ceabcc5dfcb9a2664d57d68d7e6655af29e286fc01. Source text hash: 24247e167cfacfe82789f2b11ce2c0fc3b8a6740057b9f5148855918eb6b7b31. ## Revision and source-check history ### Version 1 — 2026-11-13T18:33:24.930Z Cloudflare says its private origins service is now generally available, allowing customers to point a proxied DNS record at a private IP and route requests to the origin over existing Cloudflare One connectivity. The origin stays private, while Cloudflare says services including WAF, caching, bot management, and Workers work as they do for public origins. The change addresses a problem Cloudflare says customers raised: internal APIs, AI agent backends, MCP servers, and operational tools need to receive Internet requests without being built to face the Internet. Cloudflare says earlier approaches could require exposing a public IP, opening a firewall port, or running cloudflared alongside the origin. Access requires a Private Origins entitlement and Cloudflare One connectivity; some features remain unsupported or require Load Balancing. Cloudflare says work is underway on private-to-private traffic, with a closed beta targeted for early 2027. ## Original source Cloudflare Blog · Article Original source date: Oct 30, 2026 (2026-10-30T14:23:43.668Z). Date basis: Date stated by the publisher. Added to Escape Meridian: 2026-11-13T18:33:24.930Z. First observed: 2026-10-30T14:24:36.880Z. Retrieved: 2026-10-30T16:48:35.536Z. - [Cloudflare services for private origins is now generally available](https://blog.cloudflare.com/private-origins-public-to-private/) ## Limits Cloudflare says access requires a Private Origins entitlement, Cloudflare One connectivity, and Unified Routing unless connecting over Cloudflare Tunnel. The source names unsupported features and a requirement for origin health checks, but refers readers to developer documentation for the full list of current limitations. Private-to-private traffic is described as in development, with a closed beta targeted for early 2027; the source does not report results or a release date. ## Open question Which application services or connectivity setups remain unsupported beyond the exclusions Cloudflare lists? ## Source-stated Cloudflare says its private origins service is generally available and routes requests to a private IP over existing Cloudflare One connectivity. > Point a proxied DNS record at a private IP, and Cloudflare reaches the origin over your existing Cloudflare One connection. - [Supporting source](https://blog.cloudflare.com/private-origins-public-to-private/) ## Source-stated Cloudflare says the origin remains private while several application services work as they do for public origins. > Your origin stays private, while web application firewall (WAF), caching, bot management, and Workers work just as they do for public origins. - [Supporting source](https://blog.cloudflare.com/private-origins-public-to-private/) ## Source-stated Cloudflare says customers raised the need to let Internet users reach internal services that were not built to face the Internet. > Their internal APIs, AI agent backends, MCP servers, and operational tools weren’t built to face the Internet, but those services still need to accept requests from partners, customers, or agents over the Internet. - [Supporting source](https://blog.cloudflare.com/private-origins-public-to-private/) ## Source-stated Cloudflare says some features are unsupported, and origin health checks require Load Balancing. > Argo Smart Routing and Dedicated CDN Egress IPs aren’t supported, and origin health checks require Load Balancing. - [Supporting source](https://blog.cloudflare.com/private-origins-public-to-private/) ## Source-stated Cloudflare says it is working on private-to-private traffic and targets a closed beta in early 2027. > Engineering work is underway, and we’re targeting a closed beta in early 2027. - [Supporting source](https://blog.cloudflare.com/private-origins-public-to-private/) ## Source and contributor context Cloudflare · Publisher The publisher is identified here. No individual author has been inferred. ## Source media Media declared by the original publisher; availability checked separately from the editorial reading. - [BLOG-3230 Feature Image · Cloudflare Blog](https://blog.cloudflare.com/_image?href=https%3A%2F%2Fblog.cloudflare.com%2F_emdash%2Fapi%2Fmedia%2Ffile%2F01KW44TXMXRJ1NFA38CJB0MT3A.png&w=1280&h=720&f=webp&fit=cover&position=center) ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## API An application programming interface: a defined way for software to request data or actions from another system. - [Definition reference](https://developer.mozilla.org/en-US/docs/Glossary/API) ## AI agent An AI system that chooses and carries out actions toward a goal, often using software tools. - [Definition reference](https://www.ibm.com/think/topics/ai-agents) ## Cloudflare Cloudflare provides networking, security and computing services that help run websites and applications. - [Explore this context](/entities/cloudflare) - [Reference](https://blog.cloudflare.com/) ## Editorial provenance Version 1. Publication ID: d4c5fc2d-06f7-4bd6-8804-9420a072e969. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-13T18:33:24.930Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 9211edbf8a1eee5c122206ceabcc5dfcb9a2664d57d68d7e6655af29e286fc01. Source text hash: 24247e167cfacfe82789f2b11ce2c0fc3b8a6740057b9f5148855918eb6b7b31. ### uncertain — 2026-11-13T18:33:24.930Z — anthropic/claude-opus-5.5 Publication: d4c5fc2d-06f7-4bd6-8804-9420a072e969 attribution — pass: The reading consistently attributes the general-availability announcement, the customer problem, the limitations and the 2027 roadmap to Cloudflare. It does not present Cloudflare's assertions as established facts or as Escape Meridian's opinion. > Today, Cloudflare services for private origins is generally available. summary — uncertain: The summary is faithful, but a non-specialist reader may not follow it. It leaves central terms unexplained: origin (the server hosting the app), proxied DNS record, private IP, WAF (the summary never expands it), MCP servers, Cloudflare One and cloudflared. It also never says plainly why this matters for AI agent backends. Smallest repair: briefly gloss origin, private IP and WAF, and add tooltip entries for MCP and proxied DNS. The question is also narrow, since the documentation the source cites largely answers it. > Your origin stays private, while web application firewall (WAF), caching, bot management, and Workers work just as they do for public origins. date — pass: The originalPublished value (2026-10-30T14:23:43Z, from the publisher page) matches the feed entry and is consistent with the post's own 'Today' announcement framing. It refers to the June beta as an earlier event, so this is the first publication of this post. support — pass: Each claim matches its verbatim excerpt. The access requirements, the unsupported features (Argo Smart Routing and Dedicated CDN Egress IPs), the Load Balancing requirement for health checks, and the early-2027 closed-beta target are all source-stated. The reading claims no demonstrated benefits or outcomes beyond Cloudflare's own statements. > Argo Smart Routing and Dedicated CDN Egress IPs aren’t supported, and origin health checks require Load Balancing. media — pass: The selected media ID is the verified direct link to the original Cloudflare blog post, which is the most direct way for readers to access the source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/9ff635bba830d0d800529c87e12c896cb95f8506bcccc9323153da75f3bd8140/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/cloudflare-services-for-private-origins-is-now-generally-9ff635bb.json)