LayerV vs Cloudflare Access
Private by Default. Access Issued by Code.
Give your app a stable cryptographic identity and issue access only when a person or agent needs it. LayerV combines hidden origins, signed resource access, and task-sized grants in one developer workflow. Cloudflare Access and Tunnel also protect private origins; the difference to evaluate is how your application names resources, verifies grants, and creates access for each task.
Architectural Difference
A Cryptographic Resource ID (CRID) gives the resource a cryptographic identity independent of its network address. The identifier grants no access. A qURL carries a separate, signed grant for that resource; a compatible opener verifies it before requesting access. LayerV checks authorization before opening the protected origin connection.
LayerV starts with the resource. Keep the app private, publish it through an outbound connector, and create an access link when someone needs to use it. The recipient opens the web app in a browser without a LayerV account or CLI installation.
The same workflow extends to software: the qURL SDKs, API, and MCP tools can issue links as part of an application or agent task. Link expiry, use limits, and revocation let you manage access separately from the lifetime of the resource. Keep application sign-in wherever the app needs to verify the user.
Cloudflare Tunnel also connects outbound from a private origin. Cloudflare Access controls application access through policies, with public-hostname and private-application modes and service tokens for machines. LayerV’s distinction is the resource-and-link workflow: publish once, issue access as needed, and withdraw the grant when the work is done.
Feature Comparison
| Feature | LayerV | Cloudflare Access |
|---|---|---|
| Private origin | An outbound connector can reach a private HTTP origin | Tunnel uses outbound connections; no inbound origin ports required |
| Access model | Resource-scoped access links with configurable expiry and use limits | Application policies for public or private applications |
| Recipient experience | Open an access link in a browser; retain application login where needed | Depends on application type and policy; browser and client-based access are available |
| Machine access | Mint and redeem links with the SDK or API | Service tokens support machine authentication and configurable expiry |
| Credential handling | Treat links as secrets; revoke individual links or retire a resource | Manage policy, service-token rotation, and revocation |
| Origin configuration | Close other public routes to enforce access through LayerV | Keep the origin private and route application traffic through the configured tunnel |
| Resource identity | CRID derived from the resource key; identity is separate from location and access | Application access policy and Cloudflare network integration |
Why teams choose LayerV
Give a contractor access to an internal app, send a customer a private preview, or let an agent reach an API for a task. LayerV brings these workflows together around one published resource and fresh access links. Your app stays on its own host; you control the access window and can withdraw individual links.
Frequently Asked Questions
What does the LayerV free tier include?
The free tier includes 10 active protected resources, unlimited qURLs per resource, and 10 GiB/month of data transfer (request + response). Contact the team about larger deployments and support requirements.
What does LayerV add beyond a tunnel?
An outbound tunnel supplies transport. LayerV combines that private path with cryptographic resource identity, signed access grants, and authorization before the origin connection opens. Your code can issue and revoke access for one task without giving the recipient general network access. ngrok and Cloudflare also offer authentication and policy controls; outbound connectivity alone is not the distinction.
Does Cloudflare Tunnel also keep the origin private?
Yes. Tunnel establishes outbound connections, and Access can apply user or machine policies. LayerV focuses on giving people and agents access to individual resources through links that fit directly into your workflow.
How do recipients use a LayerV link?
A browser recipient opens the link without a LayerV account or CLI. Software uses a compatible SDK or the documented token-resolution API. Your application can retain its own sign-in and permissions.