Summary
On August 14, 2026, Cloudflare added native ways to put Cloudflare Access in front of Workers: attach an Access policy to a Worker so every route, custom domain, and preview URL stays protected, make all Workers private by default with per-Worker bypasses, and read the authenticated identity in code via ctx.access.getIdentity().
What changed
Cloudflare One added Access for Workers: policies bound to the Worker itself (covering all associated domains and preview URLs), an option to make every existing and new Worker private by default with explicit bypasses, ctx.access.getIdentity() returning email, name, and groups without manual JWT validation, local testing via a dev block in wrangler.jsonc, and toggles for previews-only or previews-and-production.
Why it matters
As Workers increasingly host agent backends and MCP servers, making authenticated-by-default access a one-line platform primitive reduces the risk of exposed internal endpoints and shifts auth left, before application code runs.
Evidence excerpt
You can now enable Access on a Worker or all Workers at once ... every associated domain and preview URL stays protected ... Calls to ctx.access.getIdentity() return the user's email, name, and groups with no manual JWT validation.