Announced in closed beta in June, the service is now generally available with a simplified configuration: private IP addresses are automatically detected in proxied DNS records, and private routing can be configured through the DNS API. Enrique Somoza, product development manager at Cloudflare, writes: We rolled out this capability (...) to address a problem we kept hearing from customers: Their internal APIs, AI agent backends, MCP servers, and operational tools weren't built to face the Internet, but those services still need to accept requests from partners, customers, or agents over the Internet. Existing Cloudflare connectivity can be used to apply WAF, bot management, rate limiting, caching, and Workers to private origins, just as with public-facing applications.
The service also supports private TCP/UDP origins through Spectrum and private connectivity for Workers. Somoza adds: Those requirements often left private applications without the same protections and controls they used for public applications, including WAF, bot management, rate limiting, caching, traffic acceleration, rewrites, and Workers. Using Private Origins requires a Private Origins entitlement, Cloudflare One connectivity, and Unified Routing (not required when using Cloudflare Tunnel).
