Releasesby GlyphAI Gateway - Control AI costs with spend limits
AI Gateway now supports spend limits , cost-based budgets that track cumulative dollar spend and block requests when the budget is exceeded. Unlike rate limiting, which caps the number of requests, spend limits track actual cost based on token usage and model pricing. You can scope limits by model, provider, or custom metadata dimensions.
Also shipped Jun 5, 2026Cloudflare in June 2026 →
What's new in Sigma
AI Create AI columns (Beta) You can now create AI columns to enrich your data using natural language prompts. AI columns allow you to construct dynamic prompts that reference specific table columns, and can be helpful for tasks like enriching, summarizing, and classifying data. See Create AI columns (Beta) for more information.
Sandboxes, Infrastructure as Code
This week, Sandboxes are available in Priority Boarding from the dashboard and CLI, and Infrastructure as Code is available experimentally in CLI 5.2.0. Both features use the [Railway TypeScript SDK](https://github.com/railwayapp/railway-ts-sdk) (yes, we released a TypeScript SDK too).
Inbound SCIM Groups for Enterprise Connections is now Generally Available!
We’re pleased to announce that support for Groups within Auth0’s [Inbound SCIM](https://auth0.com/docs/authenticate/protocols/scim/configure-inbound-scim) for Enterprise Connections capability is now Generally Available (GA)!
Taxonomy MCP: Branch management and Create tools
Description: You can now build, iterate on, and ship tracking plan changes entirely through AI-assisted workflows. The Amplitude MCP server now includes create and branch management tools for taxonomy, bringing a workflow that was previously only available in the Amplitude UI to any AI assistant.
Web Experiment: Mutex groups, Holdout groups, and Experiment dependencies [Beta]
Description: As your experimentation program scales, controlling how experiments interact becomes critical. Web Experiment now supports mutual exclusion groups, holdout groups, and flag dependencies so you can run a more rigorous, isolated testing program. Mutual exclusion groups prevent users from seeing multiple experiments at once.
Per-Condition Retry Configuration
The new X-Fal-Retry-Config request header replaces all-or-nothing retry behavior with a separate retry budget per failure condition, allowing retry policy to be tuned independently for each failure mode.
More from Cloudflare developer platformEvery Cloudflare developer platform release →
Workflows - Rollback support now available in Workflows
Workflows now supports saga-style rollbacks, allowing you to add compensating logic to each step.do() in case of downstream failures. If the instance fails, the rollback handlers will execute in reverse step-start order.
Radar - Finer-grained chart granularity on Cloudflare Radar for longer time ranges
Radar now provides finer-grained traffic charts for longer time ranges. Previously, selecting a 1-3 month view on HTTP and NetFlows charts defaulted to weekly aggregation, which was too coarse to surface meaningful trends. Views longer than 3 months defaulted to monthly aggregation, returning as few as 7 data points for a 6-month range.
Gateway, Cloudflare Mesh, Workers VPC - Filter Workers' public Internet traffic using Gateway policies
Workers using a VPC Network binding with network_id: "cf1:network" now egress to public Internet destinations through Cloudflare Gateway . This means your existing Zero Trust traffic policies , DNS, HTTP, Network, and egress , extend to traffic that originates from your Workers, the same way they do for WARP users today.
Access - Share identity providers across accounts with IdP federation
Cloudflare Access now supports IdP federation , which allows organizations to share a single identity provider across multiple Cloudflare accounts. Instead of configuring the same IdP (for example, Okta or Entra ID) separately in every account, you configure it once in a source account and share it with the other accounts in your organization.
Cloudflare Fundamentals, Workers, D1, R2, KV, Queues, Vectorize, Durable Objects, Containers - Billable usage and budget alerts now in product sidebars
Pay-as-you-go customers can now view billable usage and create budget alerts directly from the product overview pages for Workers & Pages , D1 , R2 , Workers KV , Queues , Vectorize , Durable Objects , and Containers . A new sidebar widget shows current-period spend and the billing cycle date range, alongside a button to create a budget alert.
Pipelines, Workers - Pipeline binding configuration field renamed to stream
The pipeline field inside the pipelines binding configuration in your Wrangler configuration file has been renamed to stream . The old field is deprecated but still accepted. Update your configuration to use stream to avoid the deprecation warning.
Access - SAML assertion encryption for identity providers
Cloudflare Access now supports SAML assertion encryption for identity provider integrations. When turned on, your identity provider encrypts SAML assertions using a Cloudflare-managed certificate before sending them through the user's browser. Only Access can decrypt these assertions, protecting sensitive identity data even after TLS termination.
Cloudflare Fundamentals - Introducing self-managed OAuth clients
Today we are launching self-managed OAuth, enabling developers to build third-party applications that integrate with Cloudflare via OAuth. This provides a more secure, user-friendly, and manageable alternative to API tokens. OAuth lets third-party applications act on behalf of a user to access their Cloudflare account.