Secure all your internal vibe-coded applications — in one click

Cloudflare has changed how authentication policies are applied to Workers. Previously, engineers had to configure Access policies separately for each domain or hostname where a Worker was reachable. This created maintenance overhead and risked exposure if new domains were added without updating policies. The new system attaches policies directly to Workers, so any domain or URL associated with that Worker inherits the authentication requirement automatically.

The change reduces operational friction for teams deploying internal applications. Engineers no longer need to remember to secure each deployment or coordinate with security teams for every new domain. Account-wide policies can enforce authentication by default for all Workers, while still allowing per-Worker exceptions. This shifts security from being an individual responsibility to a platform-level default, which is particularly valuable for organizations where non-security teams deploy Workers.

For developers, the integration simplifies working with authenticated users. Previously, extracting user identity required manual JWT validation. Now, authenticated requests include the user's identity in the Worker context object, accessible via `ctx.access.getIdentity()`. This removes boilerplate code and reduces the risk of implementation errors. The identity data includes email, name, and group memberships, enabling fine-grained access control or personalization within the Worker code.

The system maintains flexibility for different use cases. Policies can be scoped to cover only preview URLs, only production traffic, or both. This allows organizations to keep production Workers public while still securing development versions. Service tokens can be used for programmatic access, and existing identity providers can be connected to maintain single sign-on. The priority order for conflicting policies (hostname > Worker > account) ensures predictable behavior when multiple policies apply.