Cloudflare opens OHTTP Gateway beta that refuses to decrypt requests coming through Cloudflare

Cloudflare has launched a closed beta of its OHTTP Gateway, a managed endpoint that decrypts Oblivious HTTP requests (RFC 9458) on an origin's behalf. The Gateway deliberately refuses to decrypt requests arriving from Cloudflare Workers or hosts proxied through Cloudflare, so the relay and decryption hops stay with separate operators. Cloudflare does not provide a relay — teams must run their own.

• OHTTP Gateway decrypts RFC 9458 requests, splitting client IP and content between relay and gateway
• Gateway refuses to decrypt requests arriving via Cloudflare Workers or Cloudflare-proxied hosts
• No relay is provided by Cloudflare — teams must self-host one
• Gateway binds to a zone and listens at the fixed path /.well-known/ohttp-gateway