Dispatch
Cloudflare Access attaches auth to a Worker itself, not a hostname — covering workers.dev and preview URLs automatically
Announced August 14, 2026, Cloudflare Access for Workers binds an authentication policy to the Worker rather than the route, so it applies across custom domains, workers.dev and preview deployments without per-developer configuration. This was made possible by FL2, Cloudflare's Rust proxy, which separates Workers routing from execution so Access can run before routing resolves; authenticated identity is then readable via ctx.access.getIdentity() with no manual JWT validation. The stated motivation is AI-assisted apps being deployed publicly by accident — the preview-URL coverage is the part that actually closes the common leak.
↳ Follow the thread