Cloudflare Access and Forculus
Cloudflare Access puts sign-in in front of Workers and other apps in your own Cloudflare account. It's free for up to 50 users and $7 a user a month after that, paid yearly, and you set up the account and the Access policy yourself. Forculus runs on Cloudflare too and does that part for you: every app is private from its first deploy, shared by email, and listed for IT.
Updated
What follows about Cloudflare comes from its own docs and pricing page, read on 22 October 2026 and listed at the end.
What Cloudflare Access does for a Worker
- In the dashboard, a Worker's Access tab protects it, for previews only or for all traffic. That covers every domain the Worker has, its
workers.devaddress and previews included. One setting can protect every Worker in the account. - The ready-made policies let in members of the Cloudflare account, or verified addresses at an email domain you enter. Other policies can allow, block, bypass or require a service token, by email, email domain or identity provider group. Requests a bypass policy lets through aren't logged.
- The Worker reads who signed in with
ctx.access.getIdentity(). - Cloudflare Access is free up to 50 users. Past that, pay-as-you-go is $7 a user a month, paid yearly, or a contract at a custom price.
Side by side, for an internal app
| What | Cloudflare Access | Forculus |
|---|---|---|
| Setting it up | Your Cloudflare account, the Worker and an Access policy. Other identity providers are added in Zero Trust | Nothing. Every app starts private, and you share it by email |
| Price for the people who sign in | Free up to 50 users. Past that, $7 a user a month, paid yearly | Per workspace. Viewers don't count |
| Who is calling, in your code | ctx.access.getIdentity() in the Worker | A signed token on every request, checked by SDKs for Node, Python, Go and Rust |
| Removing someone | Changed in the Access policy | Within 60 seconds, open connections included |
| Who owns the account | You | We do. Apps run in our Cloudflare account |
When Cloudflare Access is the better fit
When your apps are Workers in your own Cloudflare account, your company already runs Cloudflare Zero Trust, and someone there looks after the policies. You keep everything in your own account.
When Forculus is the better fit
When the people building apps aren't the people who run your Cloudflare account. Staff ship from Claude Code, Codex or Cursor, every app starts private, they share it themselves by email, and IT gets one list of every app with its owner, who can open it and who opened it, plus an audit log of every request let in or refused.
Questions
Is Cloudflare Access free?
Free up to 50 users. Past that, $7 a user a month on pay-as-you-go, paid yearly.
Does Forculus use Cloudflare Access?
No. Forculus runs on Cloudflare's network and signs people in itself, through its own edge in front of every app.
Can my apps stay in my own Cloudflare account?
Not on Forculus. Apps deployed here run in our account. If they have to stay in yours, Cloudflare Access is the way to protect them.
Sources
- Cloudflare Access, Cloudflare's Workers docs, updated 12 October 2026. Checked 22 October 2026.
- Access policies, Cloudflare One docs, updated 1 October 2026. Checked 22 October 2026.
- Cloudflare Access, Cloudflare's product and pricing page. Checked 22 October 2026.
Next
- Security: what our edge checks on every request
- How we differ from other ways to keep an app private
- Pricing