gRPC APIs Get Cloudflare’s Security and Performance Stack

Cloudflare is announcing beta support for proxying gRPC traffic. The new capability brings the company’s security, reliability, and performance features—traditionally reserved for REST-based APIs—to the binary serialization protocol. Interested customers can sign up for the beta in the Network tab of the Cloudflare dashboard.

gRPC's efficiency and bi-directional streaming have made it a compelling choice for large-scale APIs, but those advantages come from a reliance on HTTP/2. Most reverse proxies, including Cloudflare's own stack, degrade HTTP/2 requests to HTTP/1.1 before forwarding them to an origin. That incompatibility left gRPC APIs without the protective layers of a web application firewall (WAF) or DDoS mitigation. With the new support, gRPC customers can leverage Cloudflare’s existing toolset—applying WAF and Bot Management, enabling Argo Smart Routing, or distributing load across backends—without abandoning their protocol of choice.

Why gRPC Has Outgrown the Datacenter

Traditional JSON-REST APIs remain widely used because they run over HTTP, produce human-readable payloads, and are easy to wire up. But those very traits create overhead: JSON is inefficient to store and transmit and computationally expensive to parse. Google introduced gRPC in 2015 to address these shortcomings by serializing messages with binary protocol buffers before transmission. Although not human-readable, this approach delivers dramatic processing efficiencies. gRPC was conceived for microservices within datacenters but has since found broader adoption, including mobile applications where clients and servers exchange messages over the public Internet.

Rolling Out gRPC at the Edge

Adding gRPC support required engineering changes in several areas of Cloudflare’s infrastructure:

  1. Identification of gRPC traffic in the early stages of the request processing pipeline.
  2. WAF integration so that managed rules can inspect gRPC connections, including all components of the initial handshake.
  3. HTTP/2 support to origins for gRPC proxying. This capability is currently limited to gRPC traffic, with plans to broaden it to other traffic types.

For customers, this means enabling gRPC is as simple as flipping a switch in the dashboard. The features that already attach to Cloudflare APIs are available for gRPC, including pairing with API Shield for mTLS authentication at the edge. Practical benefits highlighted by Cloudflare include:

  • WAF: Incoming gRPC requests can be inspected with managed rules or custom rules.
  • Load Balancing: Multiple gRPC backends can be configured, with traffic distributed across them using round-robin, health checks, or load metrics.
  • Argo Smart Routing: gRPC messages travel across less congested paths, reducing time to first byte by an average of 30%.

This is especially relevant for mobile applications that depend on gRPC endpoints. Those endpoints were previously exposed directly to the Internet, without the security benefits of a WAF or volumetric DDoS protection.

Getting Started with the Beta

Customers can request access from the Network tab in the Cloudflare dashboard. After the switch is toggled, enabling Cloudflare proxying on the DNS tab activates gRPC support on the domain. Cloudflare stated that seats are limited at launch but the beta will expand over the following weeks.