Badge-based access: Cloudflare’s Gateway Authorization Proxy explained

Most security teams aim for full device management, where every endpoint runs a client such as the Cloudflare One Client for complete visibility. Real-world deployments, however, often don’t allow that. Acquisitions bring in unfamiliar hardware, virtual desktop environments lack persistent local agents, and regulated industries restrict software installation on endpoints. Those devices still need filtering and control, even when they can’t be managed directly.

Cloudflare’s answer is to shift the identity check from the device to the network layer. The newly launched Gateway Authorization Proxy and Proxy Auto-Configuration (PAC) File Hosting combine the browser’s built-in proxy settings with Cloudflare’s edge network to verify users and enforce granular policies on any device able to reach the internet—no client software required.

From IP-based identification to per-user policy

The previous approach relied on proxy endpoints first released in 2022. Those endpoints routed traffic through Cloudflare for filtering but identified users solely by their source IP addresses. That worked only if users stayed on predictable networks—a dynamic that breaks down as soon as someone works from a new office, home connection, or public Wi-Fi. Administrators were left with logs that contained IPs but not the people behind them, and policies that required manual updates each time an IP changed. Teams also had to host their own PAC files, adding another piece of infrastructure to manage.

The Gateway Authorization Proxy replaces that static model with an Access-style login flow. It still routes traffic through Cloudflare, but now the proxy checks who is making the request before deciding what to filter.

Identity without an installed client

The key difference is authentication before authorization. Instead of recognizing a license plate, the proxy validates a personal badge. That allows for meaningful per-user logs and policies—an administrator can restrict access to an accounting tool to the Finance team even if those users rotate through different machines or leave the corporate network.

Support for multiple identity providers makes the feature practical for complex organizations. Administrators can present one or several login methods—such as Okta and Azure AD together–so users from different parts of a merged company can authenticate with the identity system they already use.

Billing stays aligned with existing Cloudflare One client seats. Each authenticated user occupies a single seat, with no separate metering to track.

How authentication is tracked

Reconciling requests to a user identity without a client on the device requires careful cookie handling. The Authorization Proxy relies on signed JWT cookies, but a user’s first visit to any new domain raises a problem: there’s no identity cookie for that domain yet. The proxy resolves this with a redirect flow:

  • First request to a domain: The proxy sees no domain identity cookie and redirects to Cloudflare Access.
  • Checking existing session: If the user already has an Access identity cookie, a secure per-domain token is generated. If not, the user sees a login page for the configured identity providers.
  • Fast and transparent: With the redirect handled from the edge, the entire exchange completes in milliseconds and the user simply sees their page load.
  • Later requests: Once the domain cookie is set, all further requests to that domain and its subdomains are authorized instantly, with no redirect.

The scheme enables per-user filtering and logging across every domain a user visits and allows immediate revocation when needed—all without touching the device’s filesystem.

Managed PAC file hosting

Setting up an unmanaged device to point at a proxy can be one of the most tedious parts of clientless adoption. Cloudflare now hosts the PAC files that browsers need to locate the proxy, so teams no longer have to maintain their own infrastructure for that piece of the configuration.

Canned starter templates cover common routing patterns, and the AI assistant Cloudy can summarize what a given PAC file actually does before you deploy it—making it easier for engineers to review policies without carefully reading every line of PAC rules.

When the Authorization Proxy fits

Cloudflare still recommends its full client for maximum control and the smoothest end-user experience, but the Auth Proxy is aimed squarely at a few recurring cases:

  • Virtual desktop infrastructure (VDI): Users on virtual machines rely on a browser for internet access, leaving no stable local agent to identify them.
  • M&A scenarios: Integrating two companies’ security policies at network level avoids waiting for device enrollment to complete.
  • Compliance-constrained environments: Sectors that legally or technically ban endpoint software still get identity-based filtering coverage.

The current implementation supports Access JWT-based identity. Cloudflare already has eyes on extending the authentication methods for the authorization endpoints, naming Kerberos, mTLS, and traditional username/password flows as the roadmap.

The Gateway Authorization Proxy and PAC File Hosting are in open beta for all account types as of this writing. They can be enabled from the “Resolvers and Proxies” area of the Cloudflare dashboard, and the relevant endpoints are documented in Cloudflare’s developer interfaces.