What changed in the Cloudflare API

When you deploy a Worker, Wrangler bundles your code and compresses it before uploading. Previously, Cloudflare checked that compressed size and rejected deploys over 3 MB (Free) or 10 MB (Paid). That

Deploy larger Workers — up to 64 MiB for both free and paid plans
You can now deploy Workers with larger dependencies, heavier frameworks, and more code without hitting size limits.
When you deploy a Worker, Wrangler bundles your code and compresses it before uploading. Previously, Cloudflare checked that compressed size and rejected deploys over 3 MB (Free) or 10 MB (Paid). That limit has been removed. Cloudflare now only checks the uncompressed size of your bundle, which is 64 MiB across all plans.
To check your Worker's bundle size before deploying:
 value is your uncompressed bundle size. This is what counts against the 64 MiB limit. The 
 value is shown for reference but is no longer a limit.
Worker size limits documentation
Python Workers now support WSGI web frameworks like Django and Flask
Python web frameworks following the 
Web Server Gateway Interface (WSGI)
Asynchronous Server Gateway Interface (ASGI)
 specification can now be used in Python Workers.
Using web frameworks with Python Workers
Based on the web framework you are using, you can use either 
For WSGI frameworks like Django or Flask:
 is equivalent to creating a 
 method. If you want more control over the 
For 

If some routes in a batch fail (for example, an invalid CIDR), the routes that were created successfully are removed from the form automatically, so you only need to fix and resubmit the ones that fai

Define custom applications for breakout and prioritized traffic from the Cloudflare One Appliance dashboard
 directly from the dashboard, without calling the API.
Assign application traffic
 to create a custom application matched by 
 field, alongside Cloudflare-managed applications.
Edit or delete an existing custom application from the same panel, no API round-trip required.
 lets you match traffic by its source IP range, complementing the existing 
source LAN interface breakout criteria
This complements the existing API and Terraform workflow for managing applications.
Configure DHCP options from the dashboard on Cloudflare One Appliance
 directly from the dashboard when the 
 is acting as the DHCP server for a LAN.
 to choose from common options for PXE / iPXE boot, VoIP phone provisioning, and vendor-specific configuration, or select 
 to enter your own option code, type, and value.
This complements the existing 
API and Terraform workflow
 for configuring DHCP options.
New in Images: text rasterization and updates to the binding
We've added more ways to manage and manipulate images with the 
Render text into an image.
 Output a string of text into its own image or draw it ove

AI Gateway monthly usage invoices, issued at the beginning of each month for the previous month's usage, now show a single total cost for each model. These invoices no longer break out input and outpu

AI Gateway consolidates monthly usage invoice line items and standardizes model names
AI Gateway monthly usage invoices, issued at the beginning of each month for the previous month's usage, now show a single total cost for each model. These invoices no longer break out input and output token quantities and unit prices into separate line items. This change does not apply to invoices for AI Gateway credit purchases.
For example, an invoice that previously included these separate line items:
anthropic claude-haiku-4-5-20251001 Input Tokens
: 40,000 tokens at $0.000001 ($0.04)
anthropic claude-haiku-4-5-20251001 Output Tokens
: 24,000 tokens at $0.000005 ($0.12)
The updated invoice includes one line item: 
anthropic/claude-haiku-4.5
AI Gateway has also standardized model names across invoices and logs. Model variants that previously appeared with provider-specific version suffixes now use a consistent 
Unified Billing documentation
AI Gateway logging documentation

Your account has exceeded D1's free tier daily row read limit. Upgrade to a paid plan or wait until tomorrow (midnight UTC) to continue.

D1 enforces free tier daily query limits
Beginning September 1, 2026, D1 queries on the 
 will fail when an account exceeds the daily 
row read or row write limits
 will return errors until the limit resets at midnight UTC. Stored data is not affected.
You will receive email alerts when the daily limit is reached. The following errors indicate that a limit has been exceeded:
Your account has exceeded D1's free tier daily row read limit. Upgrade to a paid plan or wait until tomorrow (midnight UTC) to continue.
The account has reached its daily row read limit.
Your account has exceeded D1's free tier daily row write limit. Upgrade to a paid plan or wait until tomorrow (midnight UTC) to continue.
The account has reached its daily row write limit.
Inspect database query activity before the enforcement date to identify queries that may exceed these limits. To reduce row reads, add 
 to tables and review queries that perform full table scans. If usage requires higher limits after optimization, upgrade to a 
For more information on D1 errors and how to handle them, refer to the 
Crawl endpoint now respects the Content Signals `use` directive
 endpoint now respects the 
 standard, letting 

A new GA release for the macOS Cloudflare One Client is now available on the

AI Search now supports GLM-5.3 Flash
 for text generation. The model has a 1,048,576-token context window and runs on Workers AI.
To configure the model for an AI Search instance, refer to 
Cloudflare One Client for macOS (version 2026.7.1376.0)
A new GA release for the macOS Cloudflare One Client is now available on the 
stable releases downloads page
This hotfix resolves an issue where a small but noticeable percentage of DNS queries fail across platforms.
Cloudflare One Client for Windows (version 2026.7.1376.0)
A new GA release for the Windows Cloudflare One Client is now available on the 
stable releases downloads page
Fixed a rare but critical issue where the client could fail to connect or switch organizations due to an invalid registration after switching installed client versions. Additionally, this hotfix resolves an issue where a small but noticeable percentage of DNS queries fail across platforms.
Cloudflare One Client for Linux (version 2026.7.1377.0)
A new GA release for the Linux Cloudflare One Client is now available on the 
stable releases downloads page
This hotfix resolves an issue where a small but noticeable percentage of DNS queries fail across platforms.
Z.ai

Existing service token secrets continue to work and do not require rotation. Both formats use the same Client ID and the same

Access service token secrets use a scannable format
Cloudflare Access service token Client Secrets created on or after August 26, 2026, use the format 
cfast_[40 alphanumeric characters][8-character checksum]
. The prefix and checksum make these credentials easier for secret scanning tools to identify with fewer false positives.
Existing service token secrets continue to work and do not require rotation. Both formats use the same Client ID and the same 

Microsoft is deprecating the Azure Monitor HTTP Data Collector API. Support for the API ends on 2026-09-14. As a result, Cloudflare will no longer maintain the Azure Functions-based connector after th

New Workers AI text generation models in AI Search
 now supports six additional 
 models for text generation:
@cf/deepseek-ai/deepseek-v4-flash-0731
@cf/deepseek-ai/deepseek-v4-pro-0813
@cf/moonshotai/kimi-k2.7-code
These models run on Workers AI, so they do not require an additional provider key. Select a model when creating or updating an AI Search instance in the dashboard or through the API.
For the full list of supported models, refer to 
Delete Log Explorer datasets
Cloudflare Log Explorer customers can now permanently delete account and zone datasets from the Cloudflare dashboard or API.
Deletion protection is enabled by default to prevent accidental data loss. In the dashboard, go to 
, disable deletion protection for the dataset, select 
, and enter the dataset name to confirm.
To delete a dataset through the API, first set 
Update an account or zone dataset
Delete an account or zone dataset
Dataset deletion is irreversible and runs asynchronously. You cannot recreate the same dataset while deletion is in progress.
Azure Functions-based Microsoft Sentinel connector deprecation
Cloudflare Enterprise customers using the 
Azure Functions-based Microsoft Sentinel connector
Clo

Cloudflare Access administrators can now choose a grace period when rotating a service token secret. Both secrets remain valid during the grace period, giving administrators time to update services wi

Create app-scoped API tokens for Flagship
. These tokens grant access only to the Flagship apps you select, instead of every app in the account.
When you create a custom token, open the resource dropdown (it defaults to 
. Then choose the app and a 
 permission: Evaluate, Read, or Write. Account-wide Flagship Evaluate, Read, and Write permissions still exist when you need access to every app.
Use app-scoped tokens in trusted server-side environments, such as Wrangler, CI, or a backend service that should only touch one app.
To create a token, refer to 
open the app-scoped token form
Grace periods for service token rotation
Cloudflare Access administrators can now choose a grace period when rotating a service token secret. Both secrets remain valid during the grace period, giving administrators time to update services without interrupting authentication.
The dashboard offers grace periods from one hour to 30 days. Administrators can also revoke the previous secret immediately. The API accepts an RFC 3339 expiration time for custom rotation schedules.
For configuration instructions, refer to 
Rotate service token secrets
Temporarily turn off Access service tokens
Cloudflare Access ad

Dashboard SCIM now supports replacing groups using HTTP

Download the Cloudflare One Virtual Appliance for your hypervisor from the dashboard
Cloudflare One Virtual Appliance
, you can now select your hypervisor and download the appliance directly from the dashboard — no need to look up asset URLs.
, then select your hypervisor: 
Download the OVA image (VMware ESXi) or the install script (Proxmox and libvirt/KVM) for the selected hypervisor.
 to open deployment instructions for your platform.
This complements the existing self-serve 
registration and license key generation
Configure a Cloudflare One Virtual Appliance
Test Data Loss Prevention profiles without sending traffic through Gateway
Data Loss Prevention (DLP)
 evaluates sample content before you apply a profile to production traffic. Paste text, upload a file, or upload a HAR file, then select the profiles you want to test.
Test scan sends content directly to the DLP scanner. Gateway policies are not evaluated, no traffic passes through Gateway, and no Gateway activity logs are created. Results include matched profiles, detection entries, confidence levels, match context, proximity keywords, file metadata, antivirus status, and OCR output.
Test scan is available to all Cloudflare

Up to five login profiles can be saved per device, and saved profiles can be removed from the profile list at any time.

Choose OAuth scopes for Wrangler and the Cloudflare API MCP server
Cloudflare API MCP server
 now use optional OAuth scopes. During authorization, you can choose which optional scopes to grant instead of approving every scope requested by each client.
The consent dialog now includes the option to edit the permissions you grant to Wrangler or the Cloudflare API MCP server:
You can then choose which specific permissions to grant:
Required scopes remain selected. Choosing fewer optional scopes limits each tool's access to the permissions needed for your workflow.
If a command or tool call needs a scope that you declined, reauthorize the client and grant that scope.
Edit optional permissions
Automatically remediate Microsoft 365 and Google Workspace findings with API-based CASB remediation policies
 is an API-based (agentless) tool that continuously scans your SaaS and cloud applications for security misconfigurations and data exposure. You can now use 
CASB remediation policies
 to automatically fix a finding or send a webhook the moment CASB detects it, without manual triage.
Remediate Microsoft 365 and Google Workspace findings
A policy can perform a first-party remediation action d

Members with only resource-scoped Access roles can now open Access resource list pages in the Cloudflare dashboard and call list endpoints in the API. They no longer need an additional account-scoped

Enriched 403 responses for the Cloudflare API
 field that links directly to the API documentation for the endpoint that was denied. This gives developers, administrators, and agents an immediate path to the relevant docs with role information instead of guessing at which role or permission they are missing for that endpoint.
Enriched 403 error responses
: When a Cloudflare API request is denied, the error response now includes a 
 field that points to the documentation for that specific endpoint. Contextual 403 responses are now available across nearly all Cloudflare product APIs.
: The linked API docs surface the roles required for each endpoint, making it easier to self-serve access issues.
Better support for tools and agents
: Agents can use the \documentation_url` field to immediately fetch the endpoint's documentation from the 403 error response, identify the accepted permissions for the denied action, and use that context to drive third-party approval workflows.`
"https://developers.cloudflare.com/api/resources/workers/subresources/beta/subresources/workers/methods/list"
Browse the Cloudflare API documentation
Review API token permissions
Run more headless browsers concurrent

A DNS search domain parsing failure no longer prevents connection.

Cloudflare One Client for Windows (version 2026.7.1343.0)
This release introduces multiple features from our previous beta release into stable release, including:
When reauthentication is needed for any reason, the notifications are clearer and reduce the actions needed to get you back to work by redirecting to the browser for authentication instead of the app window when necessary.
When a network is blocking or otherwise not supportive of HTTP/3, the client will learn and adapt by switching the order of fallback for that network by starting with HTTP/2 first and then trying HTTP/3 if needed. This reduces delays in time to connectivity when joining older or heavily filtered networks.
Additional changes and improvements
Fixed a process leak in the Windows GUI that could exhaust system resources during IPC client-creation failures.
Fixed being unable to switch organizations when the client was stuck in the "Device not in organization" state.
Fixed an issue where Microsoft Defender would falsely flag the Cloudflare One Client installation as malicious when installing with Intune.
Made the Windows domain-joined posture check more reliable.
A DNS search domain parsing failure no longer 

Cloud Connector does not sign requests or provide OCI credentials. Your bucket must allow anonymous object reads. Private buckets and pre-authenticated request URLs are not supported.

Configure origin application settings for Cloudflare Tunnel in the dashboard
You can now configure origin application settings directly in the Cloudflare dashboard when adding or editing a published application route for a 
. These settings control how 
 connects to your origin server and were previously only available in the Cloudflare One dashboard or via local configuration files.
When editing a published application, expand 
Additional application settings
 to configure parameters organized into three categories:
 — Set a custom HTTP Host header or disable chunked encoding.
 — Configure origin server name, CA pool, TLS timeout, disable TLS verification, match SNI to host, or enable HTTP/2 to origin.
 — Tune connect timeout, keep-alive timeout, keep-alive connections, TCP keep-alive interval, proxy type, or disable Happy Eyeballs.
For the full list of origin parameters, refer to 
Post-quantum key exchange for MX deployments
Cloudflare Email Security now supports post-quantum hybrid key exchange with X25519MLKEM768 on the SMTP connections we make to receive and deliver mail. Deploying Email Security in front of a provider that supports post-quantum hybrid key agreement (like Goog

Qwen 3.8 27B now available on Workers AI

This release updates WordPress remote code execution rule metadata in the Cloudflare Managed Ruleset and Cloudflare Free Ruleset to identify CVE-2026-65640.
CVE-2026-65640: A remote code execution vulnerability affecting WordPress core and plugin components. Remote, unauthenticated attackers can execute arbitrary system commands to gain unauthorized access or establish backdoors on host servers.
Wordpress - Remote Code Execution - CVE:CVE-2026-65640
Wordpress - Remote Code Execution - CVE:CVE-2026-65640
WAF Release - Scheduled changes for 2026-08-24
HTTP/2 Request Smuggling - Request Body Anomaly
XSS - JavaScript Event Handler Coercion - Headers
XSS - JavaScript Event Handler Coercion - Body
XSS - JavaScript Event Handler Coercion - URI
XSS, HTML Injection - Script Tag - Beta
This rule will be merged into the original rule "XSS, HTML Injection - Script Tag" (ID: 
Qwen 3.8 27B now available on Workers AI
 is now available on Workers AI.
Qwen 3.8 27B is a 27-billion-parameter instruction-tuned vision language model from Alibaba's Qwen family. It processes images and text together, with reasoning and function calling for agentic workflows.
: Accept image and text inputs and generate t

DeepSeek V4 Flash and Pro now available on Workers AI

DeepSeek V4 Flash and Pro now available on Workers AI
@cf/deepseek-ai/deepseek-v4-pro-0813
@cf/deepseek-ai/deepseek-v4-flash-0731
 are now available on Workers AI.
DeepSeek V4 Flash and DeepSeek V4 Pro are the first Workers AI models with a full 
one million (1,048,576) token context window
. Use them for long-horizon agentic workflows, large codebases, and multi-step reasoning that exceed the context limits of every other model hosted on the platform.
DeepSeek V4 Flash is the faster, lower-cost sibling. This release supersedes the preview version with substantially enhanced agentic capabilities.
: Both models support thinking mode for complex, step-by-step problem-solving.
: Build agents that invoke tools and APIs across multiple conversation turns.
: Both models support a full 1,048,576 token context window.
Use these models through the 
OpenAI-compatible endpoint
DeepSeek V4 Pro model page
DeepSeek V4 Flash model page
You can now enable Access on a Worker or all Workers at once
You now have two new ways to protect your 
Protect an application across all its domains at once
Until now, if a Worker was reachable on a route, a Custom Domain, and a 
 URL, you had to manually add each

Artifacts now supports jurisdictions, allowing you to select the European Union or the United States as the only location where repo data is stored and processed.

Data localization support for Artifacts
Artifacts now supports jurisdictions, allowing you to select the European Union or the United States as the only location where repo data is stored and processed.
Select a jurisdiction when you create a namespace. Every repo in that namespace automatically uses the selected jurisdiction.
 "https://api.cloudflare.com/client/v4/accounts/
 "namespace": "my-eu-namespace",
Jurisdictions cannot be changed after namespace creation. If you omit the jurisdiction, Artifacts creates an unrestricted namespace.
For supported jurisdictions and usage details, refer to 
Detect and control software package downloads with package registry security
Cloudflare Gateway can now detect software package downloads and give you policy control over supply chain traffic. When a developer or CI/CD pipeline downloads a package through Gateway, the proxy identifies the registry protocol from the request URL and extracts the package ecosystem, name, version, and namespace. You can then write 
 selectors to allow or block package downloads.
Gateway detects package downloads for the following ecosystems:
 to access the package registry selectors. After selecting a single ecos

CVE-2026-64638: A pre-authentication reflected cross-site scripting vulnerability affecting the WordPress login screen. Exploitation requires social engineering and explicit interaction by the target

Block emails by content with blocked content rules
Cloudflare Email security now lets administrators write their own content-based blocking rules. A new 
 lets you define a plaintext string or a regular expression, choose whether to scan the message subject, body, or both, and automatically block any message that matches.
Create rules using either 
 — useful for blocking targeted phishing campaigns, known-bad phrases, or content patterns unique to your organization.
regular expression checker
 to validate your pattern against sample text before saving, so you can confirm the rule matches what you expect and avoid false positives.
Matching messages are marked with a malicious 
 and prevented from reaching users' inboxes.
Blocked content rules currently only support the block action.
This feature is available for the following Email security packages:
Pages now skips superseded queued builds
Pages now automatically skips a queued build when a newer build for the same project, branch, and deployment target is also queued.
New Cloudflare Status page
The Cloudflare Status page at 
 has been rebuilt. It is available at the same address, and every previously documented 
 endpoint remains 

Successful exploitation of CVE-2026-61511 may lead to remote code execution on affected vBulletin systems, potentially resulting in unauthorized access, data exposure, service disruption, and broader

Hostname routing is now generally available, with a new public IP range for initial resolved IPs
 is now generally available. Instead of managing static IP lists and routes, you can route traffic by hostname across multiple Cloudflare One connectors:
) to a private application behind your tunnel, or a 
) to egress through a specific tunnel and anchor traffic to a dedicated exit node.
private or public hostname's traffic
Alongside GA, the default IPv4 range used for 
A unique, ephemeral IP address that Gateway assigns to DNS queries when filtering network traffic by hostname. The IP is randomly selected from an IPv4 range (
 by default, configurable per account) or an IPv6 range (
" class="glossary-tooltip" tabindex="0" data-astro-cid-hklyqugd>initial resolved IPs
 (also called token IPs) is changing from a Carrier-Grade NAT (CGNAT) range to a public Cloudflare-owned range:
This is the default range. You can 
configure a custom initial resolved IP range
 for IPv4 if it conflicts with your existing network.
, Local Network Access (LNA) restrictions block background requests to CGNAT addresses (
), which included the previous initial resolved IP default (
). LNA is implemented at the 

A new GA release for the Windows Cloudflare One Client is now available on the

Cloudflare One Client for Windows (version 2026.6.905.0)
A new GA release for the Windows Cloudflare One Client is now available on the 
stable releases downloads page
This hotfix addresses an uncommon and intermittent case on Windows devices where the device is unable to reconnect after the device is woken from sleep.
Stream live logs from Cloudflare Tunnel in the dashboard
Real-time Tunnel log streaming is now available in the Cloudflare dashboard under 
. This brings the same live debugging capability previously only available in the Cloudflare One dashboard, including multi-connector aggregated streaming for high-availability deployments.
In the tunnel detail view, a new 
Stream logs from single or multiple connectors
 deployments with multiple 
 replicas, logs from all connectors are merged into a single stream grouped by hostname, making it easy to identify which host machine produced each log entry.
Filter by log level, event type, and HTTP method
 — Narrow the stream to only the events you care about (HTTP, TCP, UDP, or 
 internal), at any log level.
Turnstile Spin is now generally available
 is now generally available with three setup paths for creating a Turnstile widget 

The data behind both widgets is also available through two new endpoints on the

Container image for Cloudflare Mesh
 nodes can now run as Docker containers. The 
 image is available on Docker Hub for Docker Compose, Kubernetes, and any OCI-compatible runtime — no host-level package installation required.
 architectures and includes built-in 
 so return traffic routes correctly without VPC route table changes.
 and connect your entire stack to a private network.
 — deploy a standalone Mesh node with persistent registration state.
 — add the Mesh image as a sidecar container in a Pod to connect an application to Cloudflare without application changes.
 — pull the image in a pipeline step, join the Mesh, run integration tests against private infrastructure, and tear down. The node disappears when the container exits.
, run multiple replicas with the same Mesh node token. Cloudflare operates replicas in active-passive mode with automatic failover.
For setup steps, runtime configuration, and deployment examples, refer to 
Run Mesh in Docker / Kubernetes
AS-level connectivity and upstream providers on Cloudflare Radar
 with two widgets on AS pages, such as 
, that describe how a network reaches the rest of the Internet: the paths it takes toward the 
 networks, and 

Introducing Kitesurf, an agent-first browser on Browser Run

Workers AI and AI Gateway unify model access and billing
Workers AI and AI Gateway now provide a unified path for accessing models and managing inference traffic. Use the same AI binding and REST API to call models hosted on Workers AI or by supported third-party providers, with AI Gateway providing observability, logging, caching, security, and billing controls.
Unified entrypoints and observability
 supports both Workers AI and third-party models through 
 endpoints with Cloudflare authentication across providers.
Route a Workers AI request through AI Gateway by specifying a gateway ID. Use 
 to automatically create a gateway on the first authenticated request, or specify an existing gateway to separate applications and workloads:
"What is the capital of France?"
"What is the capital of France?"
Requests routed through AI Gateway can be logged and included in analytics for request volume, errors, latency, token usage, and costs. You can also configure controls such as caching, rate limiting, and request retries on the gateway.
Unified billing and higher rate limits
 to pay for Workers AI inference. This provides one credit balance for Workers AI and supported third-party model pr

Vectorize indexes now support up to 20 million vectors

Track AI spend and catch anomalous usage with User Insights
AI Gateway now includes User Insights, a dashboard that gives you two things at once: clear visibility into how much your organization spends on AI, and a security signal that surfaces users whose usage suddenly looks abnormal. It works on the traffic already flowing through your gateway, so there is no additional setup.
On the spend side, User Insights shows organization-wide totals for cost, requests, tokens, and adoption, and lets you drill into an individual user to see their spend, top models and providers, cache hit rate, and more. To attribute usage to individual users, add a user identifier with custom metadata or put your gateway behind Cloudflare Access.
On the security side, User Insights baselines each user's normal usage from their 95th percentile (p95) session cost over the last 30 days, then flags sessions that exceed both that baseline and an organization-level threshold. A sudden jump above a user's own pattern is often the first sign of a compromised credential or a misbehaving agent, so you can investigate before it shows up on your bill.
User Insights is available to all AI Gateway customers at no addit

CVE-2026-66066: An improper input processing vulnerability in Ruby on Rails Active Storage image variant transformations. This may allow an unauthenticated attacker to perform arbitrary file reads and

Identity-aware controls are now available in AI Gateway
AI Gateway now integrates with Cloudflare Access, giving you two new capabilities:
Protect your gateway endpoint.
 Put your AI Gateway behind Access so you can set policies that control who is allowed to call a specific gateway's endpoint.
 When traffic reaches AI Gateway through an Access-protected custom domain, AI Gateway can use the authenticated user's Access identity in logs, analytics, routing, and spend controls.
With identity-aware controls, you can set spend limits by authenticated user, control which gateways different users can access, filter logs by user, and build policies without passing user IDs from the client application. AI Gateway adds the verified Access user ID to request metadata as 
Agent traces for Think, Flue, and AI SDK instrumented by Agents SDK
Agent tracing is now available for applications built with the Agents SDK. Traces show each agent turn alongside model calls, tool runs, approvals, token usage, and Workers runtime operations.
Turn on Workers tracing in your Wrangler configuration:
"./node_modules/wrangler/config-schema.json"
Think and Flue applications emit agent traces automatically. For d

AI agents can debug Workers with local tracing

AI agents can debug Workers with local tracing
 automatically capture structured OpenTelemetry traces and correlated console logs during local Worker invocations.
When the tooling detects an AI agent session, it prints a terminal hint pointing to the 
. The API serves an OpenAPI schema and exposes a read-only observability query endpoint for discovering telemetry, querying traces and logs, and inspecting binding state.
The agent can identify the exact failing operation, fix the code, rerun the request, and verify the result. This debug loop requires no deployment or temporary logs.
Inspect traces in Local Explorer
Humans can inspect the same 
 and correlated console logs in the Local Explorer browser UI. Each trace shows spans, timing, attributes, and errors.
Automatic spans cover handler calls, outbound 
 calls, and binding calls. Custom spans appear alongside these automatic spans.
Local Explorer documentation
Control authorization cookies for multi-domain Access applications
Cloudflare Access administrators can now control whether a self-hosted application preemptively sets authorization cookies across its public hostnames.
Previously, Access automatically used eager redirects f