Cloudflare Birthday Week 2026: a public CA plan, payments for AI agents and new data services

Cloudflare marked its 16th birthday with a Birthday Week from 28 September to 2 October and made 46 announcements, according to a wrap-up post on its blog dated 5 October. Each day had its own theme: open source, application security and the post-quantum transition, payments for AI agents, the developer platform, and performance and observability. In the post, Cloudflare says that this year automated traffic overtook human activity for the first time, and many of the launches are built around that shift.

The plan with the widest reach concerns certificates. Twelve years after it launched Universal SSL, Cloudflare says it intends to become a public certificate authority, with the stated goal of making free, automated certificate issuance more resilient. The post gives no date. The planned CA would issue free Merkle Tree Certificates, a format intended to make post-quantum authentication practical while keeping certificate size and handshake overhead low. Related changes are already live: HTTP Analytics, Log Explorer and Logpush now show whether a request negotiated post-quantum key exchange, and Workers offers opt-in native support for the ML-KEM and ML-DSA algorithms. Cloudflare says it aims to complete its own post-quantum migration by 2029 and uses an AI tool called CryptoLabe to find and classify cryptography in its code.

Wednesday focused on what Cloudflare calls the second audience of the Internet: AI agents. Under Pay Per Use, publishers who sign up get usage reports, billing and payouts whenever verified AI buyers make use of their content. The Monetization Gateway, now in beta, lets sellers put a price on resources that sit behind Cloudflare and collect payment from agents through the HTTP 402 status code and x402. The AI Gateway also gained an Auto Router that picks a suitable model for each request to lower cost, and User Insights, which shows where a smaller or cheaper model might be enough.

For developers, Cloudflare Basin, a serverless data platform built on Apache Iceberg and Cloudflare's R2 storage, is now generally available, and so is AI Search, which adds visual search, OCR for scanned PDFs and support for any chat model. K2 is a new service for durable, ordered event streams stored on R2; Cloudflare says it spares teams from running broker clusters themselves. Workers KV Instant targets p99 read times below two milliseconds and fast replication to more than 300 locations, using the existing KV API.

The week opened with developer tooling: cf, a new command-line tool that mirrors the whole Cloudflare API for both people and agents, and the open-source Forge, the pipeline Cloudflare uses to generate SDKs, CLIs and documentation from API definitions. Cloudflare also introduced EmDash, an Astro-based CMS it presents as a spiritual successor to WordPress, which runs each plugin in an isolated Worker sandbox with capabilities that have to be approved. On the final day it added Cloudflare Traces for following a request across its platform, bundled eight observability updates, and said that, by an expanded real-user measurement method, it is now the fastest provider in 74% of the top 1,000 networks. That ranking comes from Cloudflare's own measurements.