Secure all your internal vibe-coded applications — in one click
Cloudflare introduces new Access controls for Workers, allowing organizations to enforce authentication at the application level rather than per domain, simplifying internal application security.
Cloudflare has launched tools to apply its Access authentication service directly to Workers applications, ensuring all requests are authenticated before reaching the code. Previously, Access policies had to be configured per hostname, requiring manual updates when new domains were added. The new approach attaches policies to the Worker itself, automatically protecting all associated URLs—including custom domains, workers.dev subdomains, and preview URLs—without additional configuration. This reduces the risk of accidental exposure of internal applications or data.
Organizations can now set default Access policies at the account level, applying authentication to all current and future Workers by default. Admins can choose to protect only preview URLs, all production traffic, or both. Exceptions can be made for public-facing Workers by bypassing the account-wide policy. The new Access tab in the Worker view displays which policies apply, with priority given to hostname-specific rules over Worker or account-level policies.
When Access is enabled, authenticated requests include user identity details—such as email, name, and group memberships—via the Worker’s context object (ctx). Developers can retrieve this information using ctx.access.getIdentity(), eliminating the need to manually parse and validate JWTs. This metadata can be used to personalize content, enforce permissions, or log user activity directly within the Worker.
The update also supports local development with Wrangler, allowing developers to simulate authenticated users via a configuration block in wrangler.jsonc. This enables testing of user-specific content without deploying changes or signing in through Access. For platform teams deploying Workers at scale, Access can be enforced on a dispatch Worker, ensuring all Workers deployed through a namespace are private by default. Cloudflare provides an open-source example for building an internal drag-and-drop deployment platform with built-in Access controls.