Skip to content

[Access] Protect Workers directly with Access applications#31243

Draft
kennyj42 wants to merge 4 commits into
cloudflare:productionfrom
kennyj42:kjohnson/worker-destinations-docs
Draft

[Access] Protect Workers directly with Access applications#31243
kennyj42 wants to merge 4 commits into
cloudflare:productionfrom
kennyj42:kjohnson/worker-destinations-docs

Conversation

@kennyj42

@kennyj42 kennyj42 commented Jun 4, 2026

Copy link
Copy Markdown
Collaborator

What

Adds documentation for the Worker destinations feature (SHIP-14307), which lets customers protect a Cloudflare Worker behind Access by selecting the Worker directly instead of managing URL-based routing patterns.

Changes

New pages:

  • Changelog entry -- announces the feature with the three destination types and links to setup docs
  • How-to page (worker-destinations.mdx) -- full setup guide covering Dashboard and API flows, filtering, precedence rules, uniqueness constraints, limitations, and a comparison with hostname-based protection

Updated pages:

  • choose-application-type.mdx -- expanded the Protecting Workers section with the three destination types and a link to the new how-to
  • http-apps/index.mdx -- added Worker destinations to the application type list
  • workers/configuration/previews.mdx -- cross-reference note pointing to Worker destinations as an alternative
  • workers/configuration/routing/workers-dev.mdx -- cross-reference note pointing to Worker destinations as an alternative

Related

@kennyj42 kennyj42 changed the title [Access] Document Worker destinations for self-hosted applications [Access] Protect Workers directly with Access applications Jun 4, 2026
- access
---

Access applications now support [Worker destinations](/cloudflare-one/access-controls/applications/http-apps/worker-destinations/), a new way to protect Cloudflare Workers without managing URL-based routing patterns. Instead of matching hostname patterns and keeping Access applications in sync with Workers routes, you select the Worker directly and Access covers every route automatically.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This starts assuming you are coming from Access and also know what Access is

But when I think about who this reaches - it’s the person building with Workers - and reaching them and speaking to them well is what means more of them are like “oh Access is awesome”

Suggestion would be to orient around someone who has never heard of Access understanding first that they can protect their Worker, then that this is what Access is, and then that it is now way easier because…

- A deployed [Cloudflare Worker](/workers/get-started/guide/)
- An active [Cloudflare One](/cloudflare-one/) plan

## 1. Create a self-hosted application with a Worker destination

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is why I was asking about the wrangler piece in chat — if the message here is that you can protect Worekrs directly — but the steps towards doing so all hinge on starting within Access — then something feels off?

Seems like the pieces that we are talking about already wrt dash and CLI matter towards making this a really coherent thing that can ship?

@github-actions

Copy link
Copy Markdown
Contributor

Hey there, we've marked this pull request as stale because there's no recent activity on it. This label helps us identify PRs that might need updates (or to be closed out by our team if no longer relevant).

@github-actions github-actions Bot added the stale label Jun 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

10 participants