ST-2026-160 · Authentication & identity
Cloudflare AI Search adds optional Access authentication
AI Search public endpoints can now use custom domains and optional Cloudflare Access authentication while the previous public generated-hostname behaviour remains the default.
CloudflareAI SearchAccesscustom domainauthentication
Previous state
AI Search public endpoints used generated search.ai.cloudflare.com hostnames without the documented custom-domain Access option.
Current state
A custom-domain endpoint can be protected by Access; agents use service tokens and browser users authenticate through an identity provider.
Affected users
Who needs to care
AI Search operators exposing search, chat-completions or MCP paths to users or agents.
Required response
What to do
Adopt a custom domain and Access only where endpoint authentication is required.
Evidence boundary
What the source does not prove
All additions are optional and the prior behaviour remains the default until explicitly changed.
Lifecycle history
Dated event sequence
- Authentication option released
Cloudflare published the custom-domain and Access controls.
Evidence ledger
First-party sources
- 01Cloudflare Developers — AI Search makes it easier to build a search engine for your data
Official Cloudflare changelog · 2026-08-06
Open official source ↗