Secure all your internal vibe-coded applications — in one click
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Cloudflare launched Access for Workers, a feature that attaches an authentication policy directly to a Worker rather than to individual hostnames, so the policy automatically covers every route, custom domain, workers.dev subdomain, and preview URL tied to that Worker. Policies can be set at the account level (private by default for all current and future Workers), on a single Worker, or on a Workers for Platforms dispatch Worker to protect an entire internal deployment platform. Developers can retrieve authenticated user identity (email, name, groups) via ctx.access.getIdentity() without manually validating JWTs, and can simulate an authenticated identity locally in wrangler dev via a config block. The capability was enabled by FL2, Cloudflare's Rust-based modular proxy, which allowed routing logic to be separated from execution so Access could evaluate the destination Worker before request processing.
Table of contents
Copy link Access on Workers: how it worksCopy link Keep every Worker in your account private by defaultCopy link See who is accessing your applicationCopy link Test locally before you deployCopy link Deploy an internal platform where every application is private by defaultCopy link Built on solid foundationsCopy link Try it todayCopy link AcknowledgmentsQuestions this post answers
How do I get the authenticated user's email and identity in a Cloudflare Worker without validating a JWT myself?
Enable Cloudflare Access on the Worker, then call ctx.access.getIdentity() from the fetch handler's context object to retrieve the user's email, name, and groups directly. This replaces manually parsing a JWT, verifying its signature, and extracting claims, since Access attaches the authenticated identity to ctx.access automatically once enabled. Developers wiring auth into Workers track platform changes like this via daily.dev.
Can I apply a Cloudflare Access policy to an entire account so every Worker is private by default?
Yes, Cloudflare Access can be set once at the account level so that every Worker in the account, both current and future, is private from creation onward. You can scope the policy to preview traffic only, all production traffic, or both, and bypass it for any specific Worker that needs to remain public. Platform teams standardizing default-private deployments follow Workers updates like this on daily.dev.
How can I test Cloudflare Access authenticated identity locally with wrangler dev before deploying?
Add an access block to wrangler.jsonc with a dev section specifying an aud value and a mock identity email, such as admin@company.com. Wrangler dev then returns that identity through ctx.access.getIdentity(), shaped like the production response, letting you verify per-user behavior without deploying and signing in through Access each time. Teams testing auth flows locally keep up with Workers tooling changes through daily.dev.