Start free

Checked 25 October 2026

TeamOnly vs Cloudflare Access for Workers

Short answer

Use Cloudflare Access if you already run Workers in your own Cloudflare account and are happy to set up an identity provider and policies. It is free for up to 50 people. Use TeamOnly if you want one command to put an AI-built app online with login, a database and files already handled.

Last updated Written by TeamOnly, which runs on Cloudflare too. Every Cloudflare claim links to Cloudflare’s own pages.

Cloudflare Access

Use Cloudflare Access if…

  • You already run Workers in your own Cloudflare account.
  • Your company has a Zero Trust setup, or you are happy to turn one on.
  • You have an identity provider like Google Workspace, Microsoft Entra or Okta, and someone who can connect it.
  • You want to manage hosting, databases, policies and seats yourself.
  • You have 50 people or fewer and want it free.
TeamOnly

Use TeamOnly if…

  • The person who built the tool isn’t a developer, or doesn’t want to be its IT department.
  • You don’t have a Cloudflare account and don’t want one.
  • You want nothing to configure: the login, database, file storage and secrets come with the app.
  • Your company email isn’t on Google or Microsoft. Emailed codes work for any company domain.
  • You want your AI tool to build the app the right way the first time.
  • You want one bill, with people who only use apps free.

02What changed

What is Cloudflare Access for Workers?

In August 2026 Cloudflare made it possible to put an Access login in front of a Worker straight from the Worker’s settings.

  • You can protect one Worker, or every current and future Worker in the account. The Worker gets an Access tab in the dashboard. (Cloudflare blog)
  • Cloudflare checks the login before any request reaches the Worker’s code, on custom domains, routes, workers.dev and preview URLs. (Cloudflare docs)
  • The Worker can read who signed in with ctx.access.getIdentity(), with no token checking of your own.
  • Policies can allow your Cloudflare account’s members, specific emails, an email domain or groups.
  • Cloudflare also published an open-source internal sites template: a small deploy platform on Workers for Platforms, made private with one Access policy.

It is a real step forward, and it is aimed at the same problem we are: internal apps built with AI that end up public by accident.

03Side by side

How do they compare, line by line?

 Cloudflare Access for WorkersTeamOnly
Who it’s made forDevelopers who run apps in their own Cloudflare accountAnyone who built a tool with AI, technical or not
Cloudflare accountYours, with Zero Trust turned onNot needed
Hosting the appYou deploy the Worker yourselfIncluded: npx teamonly deploy
How coworkers sign inAn identity provider you connect (Google Workspace, Microsoft Entra, Okta and others), or a one-time PIN you turn onWork Google, work Microsoft or an emailed 6-digit code, on from the start
Company-onlyYou write an email domain policySet when your company joins. Personal addresses refused
Database, files, secretsYou create D1, R2 and secrets and bind them to the WorkerCreated on first deploy, a separate set for each app
Limit an app to named peopleAn Access policy in the Zero Trust dashboardnpx teamonly access only dana@acme.com
List of every app for ITAccess applications in Zero Trust, if every app has a policyThe dashboard: every app, its owner and who can open it
Instructions for your AI toolNone specific to Accessinit adds instructions for Claude Code and Cursor
Cost, 10 peopleFree, plus your Workers plan$19/mo (Builder) or $249/mo (Team)
Cost, 60 people$7 per seat a month, billed yearly: $420/mo for 60 seats$19/mo or $249/mo. App users are free
Cost, 200 people$1,400/mo for 200 seats, billed yearly$19/mo or $249/mo. App users are free

Checked 25 October 2026. Cloudflare prices from the Access plans page (Free up to 50 users; pay-as-you-go $7 per user a month, paid yearly) and seat management docs. Seat totals assume every person who signs in holds a seat, which is how Cloudflare counts them. Workers hosting is billed separately by Cloudflare. TeamOnly: Builder is 1 builder and 3 apps; Team is unlimited builders and apps.

04Pros and cons

Pros, cons and best for

Cloudflare Access for Workers

Pros

  • Free for up to 50 people.
  • Login is checked at Cloudflare, before your code runs.
  • Works with almost any identity provider, plus device checks and service tokens for automation.
  • You keep everything in your own account.

Cons

  • You still host the app and set up its database, files and secrets.
  • Someone has to connect an identity provider or turn on one-time PIN, and write a policy that is neither too loose nor too tight.
  • Seats: above 50 people you pay per person, and people hold a seat until removed.
  • A few technical limits, per the docs: Worker-level policies don’t support WebSockets, and the identity isn’t passed through service bindings or the static assets router.

Best for A developer or IT team already on Cloudflare who wants full control.

TeamOnly

Pros

  • One command from your project to a link your team can open.
  • Company login with Google, Microsoft or an emailed code, on from the first deploy.
  • Each app gets its own database, file storage and secrets.
  • Instructions for Claude Code and Cursor, so the app fits from the start.
  • People who only use apps are free, at any headcount.

Cons

  • One app shape: a React front end with a JavaScript or TypeScript API. No Python, no containers.
  • Apps live at app.company.teamonly.app. No custom domains.
  • Okta and other SSO come with the Business plan ($899/mo), set up with your IT team.
  • Internal apps only. Nothing can be made public.

Best for Someone who built a tool with AI and wants coworkers using it today, safely.

05Together

Can I use both?

Yes, for different apps. Not on the same one.

TeamOnly apps live on teamonly.app, in our Cloudflare account, so your own Access policies don’t reach them. They don’t need to: TeamOnly checks your company login itself. Developers who run their own Workers can keep using Access for those, while everyone else deploys to TeamOnly.

If your IT team wants TeamOnly apps to use Okta or another SSO provider, that is part of the Business plan and we set it up with them.

06FAQ

Questions people ask

All questions and answers

Is Cloudflare Access free?

Yes, for up to 50 users on the Zero Trust Free plan. Above that, pay-as-you-go is $7 per user a month, billed yearly. Each person who signs in holds a seat until you remove them. Checked 25 October 2026.

Does Cloudflare Access for Workers need an identity provider?

Not to get started. New Zero Trust organizations let members of your Cloudflare account sign in. To let in coworkers who aren’t on your Cloudflare account, connect Google Workspace, Microsoft Entra or another provider, or turn on one-time PIN, and write an email domain policy.

Can Cloudflare Access send a code by email instead?

Yes. One-time PIN is an option you turn on in Zero Trust. The PIN is sent only if a policy allows that address, and it expires 10 minutes after it is requested.

Does TeamOnly use Cloudflare Access?

No. TeamOnly runs on Cloudflare Workers for Platforms with its own sign-in. Every request to an app goes through our dispatch Worker first, which checks the session and the company domain before any app code runs.

Do I need a Cloudflare account to use TeamOnly?

No. Apps run in TeamOnly’s Cloudflare account. You need a TeamOnly plan and Node.js on your computer, and nothing else.

Keep reading

Early access

Put your first tool online this week.

TeamOnly is in early access, and every plan is open now. Try it free for 14 days with no card, or subscribe. Either way, your company is ready right away, and three commands put your first app online.

Try free for 14 daysOr subscribe now

No card for the trial. Then from $19 a month, cancel any time.

Not ready? Get updates

Use your work email. We write rarely, and only when there is news worth sending.

Questions go to hello@teamonly.dev, and a person answers.