Quick answer
Oblivious HTTP separates knowledge of a client's network identity from the plaintext request. A relay sees the client IP but not the encrypted content; a gateway decrypts the request but sees the relay instead of the client. Cloudflare's new OHTTP Gateway was announced as a closed beta, complementing its existing OHTTP Relay.
Architecture
RFC 9458 Section 6 requires independent, non-colluding relay and gateway operators for the intended privacy protection. It does not prevent tracking through cookies or identifiers inside the decrypted payload. Keys must be authenticated and a fresh HPKE context generated for every request.
Trade-offs
Extra hops and cryptography can add latency. A relay cannot inspect plaintext to cache or apply content-based security rules. The gateway can apply application policies after decryption.
Validation
AiFolder has not deployed or measured this product. A future test should compare direct HTTPS and OHTTP on p50/p95 latency, failures and what each hop can observe.
Who sees what?
| Participant | Can see | Cannot normally see |
| Client | Original request and response | Internal gateway operations |
| Relay | Client IP, timing, destination gateway | Decrypted request body |
| Gateway | Plaintext request, relay connection | Client network IP directly |
| Target | Request forwarded by gateway | Original client IP through the relay |
The separation requires relay and gateway to be operated independently. RFC 9458 §6 states they cannot be the same entity if the privacy goals are to hold. The protocol does not guarantee anonymity against collusion, traffic correlation or identifying data deliberately placed in the payload. RFC 9458 §6.
What Cloudflare actually launched
Cloudflare announced a closed beta for a self-serve OHTTP Gateway, described as a paid add-on with a waitlist. It also renamed Privacy Gateway to Cloudflare OHTTP Relay. Customers already using Cloudflare for their application can pair Cloudflare's gateway with a separately operated relay; those using Cloudflare's relay should operate the gateway elsewhere. These are two different trust arrangements, not two hops that Cloudflare should operate together. Cloudflare announcement.
Deployment decision
Choose OHTTP when your app needs to hide client network identifiers from the target while still processing a request. Do not treat it as a VPN replacement: a VPN has different trust, routing and traffic-visibility properties. Avoid placing stable user IDs or unique tokens in the decrypted request if unlinkability matters.
Production checklist
- Validate and rotate gateway keys.
- Use HTTPS on both network hops.
- Minimize identifying fields in application payloads.
- Document which organization operates each component.
- Measure p50/p95 latency, failure rates and key rotation behavior.
- Test service outages and retry limits.
These checks are design recommendations, not evidence of an AiFolder deployment.
FAQ
Can a relay read the original HTTP payload? It forwards an encrypted encapsulation, not plaintext.
Does OHTTP eliminate tracking? No. Identifying request content, traffic correlation and shared operators can undermine unlinkability.
Is Cloudflare's gateway generally available? The October 2026 announcement described a closed beta. Confirm current availability before deployment.
Related AiFolder reading
Source of truth and limitations
Primary sources:
Disclosure: The vendor or standards documents above support product capabilities and protocol claims. AiFolder has not run hands-on performance, security, or device benchmarks for this article; proposed experiments remain unexecuted.
