Cloudflare now lets you expose private apps without exposing their IPs

Cloudflare has launched a generally available service called Application Services for Private Origins. It allows companies to make internal APIs, AI agent backends, and operational tools accessible over the internet to partners or customers without exposing the actual IP addresses of those services or opening inbound firewall ports on their private networks. The system automatically detects private IP addresses in DNS records and lets administrators configure the routing through Cloudflare's DNS API.

For engineers, this means they can now apply the same Cloudflare security and performance layers—like Web Application Firewall (WAF), bot management, rate limiting, and caching—to internal services that were never designed to face the public internet. The key architectural shift is that a public DNS name no longer has to mean a publicly reachable server, letting teams securely bridge their private networks with external users while keeping their infrastructure hidden. This solves a common pain point for companies trying to modernize legacy internal systems.