# TeamOnly vs Cloudflare Access for Workers

> Canonical: https://teamonly.dev/compare/cloudflare-access

Last updated 25 October 2026. Written by TeamOnly, which runs on Cloudflare too. Every Cloudflare claim links to Cloudflare's own pages.

**Short answer:** Use Cloudflare Access if you already run Workers in your own Cloudflare account and are happy to set up an identity provider and policies. It is free for up to 50 people. Use TeamOnly if you want one command to put an AI-built app online with login, a database and files already handled.

## Use Cloudflare Access if...

- You already run Workers in your own Cloudflare account.
- Your company has a Zero Trust setup, or you are happy to turn one on.
- You have an identity provider like Google Workspace, Microsoft Entra or Okta, and someone who can connect it.
- You want to manage hosting, databases, policies and seats yourself.
- You have 50 people or fewer and want it free.

## Use TeamOnly if...

- The person who built the tool isn't a developer, or doesn't want to be its IT department.
- You don't have a Cloudflare account and don't want one.
- You want nothing to configure: the login, database, file storage and secrets come with the app.
- Your company email isn't on Google or Microsoft. Emailed codes work for any company domain.
- You want your AI tool to build the app the right way the first time.
- You want one bill, with people who only use apps free.

## What is Cloudflare Access for Workers?

In August 2026 Cloudflare made it possible to put an Access login in front of a Worker straight from the Worker's settings.

- You can protect one Worker, or every current and future Worker in the account. The Worker gets an Access tab in the dashboard. ([Cloudflare blog](https://blog.cloudflare.com/workers-protected-by-access/))
- Cloudflare checks the login before any request reaches the Worker's code, on custom domains, routes, `workers.dev` and preview URLs. ([Cloudflare docs](https://developers.cloudflare.com/workers/configuration/cloudflare-access/))
- The Worker can read who signed in with `ctx.access.getIdentity()`, with no token checking of your own.
- Policies can allow your Cloudflare account's members, specific emails, an email domain or groups.
- Cloudflare also published an open-source [internal sites template](https://github.com/cloudflare/templates/tree/main/internal-sites-template): a small deploy platform on Workers for Platforms, made private with one Access policy.

It is a real step forward, and it is aimed at the same problem we are: internal apps built with AI that end up public by accident.

## How do they compare, line by line?

| | Cloudflare Access for Workers | TeamOnly |
|---|---|---|
| Who it's made for | Developers who run apps in their own Cloudflare account | Anyone who built a tool with AI, technical or not |
| Cloudflare account | Yours, with Zero Trust turned on | Not needed |
| Hosting the app | You deploy the Worker yourself | Included: `npx teamonly deploy` |
| How coworkers sign in | An identity provider you connect (Google Workspace, Microsoft Entra, Okta and others), or a one-time PIN you turn on | Work Google, work Microsoft or an emailed 6-digit code, on from the start |
| Company-only | You write an email domain policy | Set when your company joins. Personal addresses refused |
| Database, files, secrets | You create D1, R2 and secrets and bind them to the Worker | Created on first deploy, a separate set for each app |
| Limit an app to named people | An Access policy in the Zero Trust dashboard | `npx teamonly access only dana@acme.com` |
| List of every app for IT | Access applications in Zero Trust, if every app has a policy | `npx teamonly whoami`: every app, its owner and who can open it |
| Instructions for your AI tool | None specific to Access | `init` adds instructions for Claude Code and Cursor |
| Cost, 10 people | Free, plus your Workers plan | $19/mo (Builder) or $249/mo (Team) |
| Cost, 60 people | $7 per seat a month, billed yearly: $420/mo for 60 seats | $19/mo or $249/mo. App users are free |
| Cost, 200 people | $1,400/mo for 200 seats, billed yearly | $19/mo or $249/mo. App users are free |

Checked 25 October 2026. Cloudflare prices from the [Access plans page](https://www.cloudflare.com/zero-trust/products/access/) (Free up to 50 users; pay-as-you-go $7 per user a month, paid yearly) and [seat management docs](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/seat-management/). Seat totals assume every person who signs in holds a seat, which is how Cloudflare counts them. Workers hosting is billed separately by Cloudflare. TeamOnly: Builder is 1 builder and 3 apps; Team is unlimited builders and apps.

## Pros, cons and best for

### Cloudflare Access for Workers

Pros:
- Free for up to 50 people.
- Login is checked at Cloudflare, before your code runs.
- Works with almost any identity provider, plus device checks and service tokens for automation.
- You keep everything in your own account.

Cons:
- You still host the app and set up its database, files and secrets.
- Someone has to connect an identity provider or turn on one-time PIN, and write a policy that is neither too loose nor too tight.
- Seats: above 50 people you pay per person, and people hold a seat until removed.
- A few technical limits, per the docs: Worker-level policies don't support WebSockets, and the identity isn't passed through service bindings or the static assets router.

Best for: a developer or IT team already on Cloudflare who wants full control.

### TeamOnly

Pros:
- One command from your project to a link your team can open.
- Company login with Google, Microsoft or an emailed code, on from the first deploy.
- Each app gets its own database, file storage and secrets.
- Instructions for Claude Code and Cursor, so the app fits from the start.
- People who only use apps are free, at any headcount.

Cons:
- One app shape: a React front end with a JavaScript or TypeScript API. No Python, no containers.
- Apps live at `app.company.teamonly.app`. No custom domains.
- Okta and other SSO come with the Business plan ($899/mo), set up with your IT team.
- Internal apps only. Nothing can be made public.

Best for: someone who built a tool with AI and wants coworkers using it today, safely.

## Can I use both?

Yes, for different apps. Not on the same one.

TeamOnly apps live on `teamonly.app`, in our Cloudflare account, so your own Access policies don't reach them. They don't need to: TeamOnly checks your company login itself. Developers who run their own Workers can keep using Access for those, while everyone else deploys to TeamOnly.

If your IT team wants TeamOnly apps to use Okta or another SSO provider, that is part of the Business plan and we set it up with them.

We run on Cloudflare too. TeamOnly is built on Cloudflare Workers for Platforms, D1, R2 and KV. We think Cloudflare is the right place for these apps. The difference is who does the setup.

## Questions people ask

### Is Cloudflare Access free?

Yes, for up to 50 users on the Zero Trust Free plan. Above that, pay-as-you-go is $7 per user a month, billed yearly. Each person who signs in holds a seat until you remove them. Checked 25 October 2026.

### Does Cloudflare Access for Workers need an identity provider?

Not to get started. New Zero Trust organizations let members of your Cloudflare account sign in ([changelog](https://developers.cloudflare.com/changelog/post/2026-06-18-cloudflare-idp-default/)). To let in coworkers who aren't on your Cloudflare account, connect Google Workspace, Microsoft Entra or another provider, or turn on one-time PIN, and write an email domain policy.

### Can Cloudflare Access send a code by email instead?

Yes. [One-time PIN](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/one-time-pin/) is an option you turn on in Zero Trust. The PIN is sent only if a policy allows that address, and it expires 10 minutes after it is requested.

### Does TeamOnly use Cloudflare Access?

No. TeamOnly runs on Cloudflare Workers for Platforms with its own sign-in. Every request to an app goes through our dispatch Worker first, which checks the session and the company domain before any app code runs.

### Do I need a Cloudflare account to use TeamOnly?

No. Apps run in TeamOnly's Cloudflare account. You need a TeamOnly plan and Node.js on your computer, and nothing else.

## Keep reading

- [Every option, side by side](https://teamonly.dev/compare)
- [How to share an AI-built app with your team](https://teamonly.dev/guides/share-an-ai-built-app-with-your-team)
- [Company-only login](https://teamonly.dev/company-login)
- [Security details](https://teamonly.dev/security)

Try it free for 14 days, no card: https://teamonly.dev/pricing#trial. Or subscribe: https://teamonly.dev/pricing#subscribe (Builder $19/mo, Team $249/mo)
Not ready? Get updates: https://teamonly.dev/waitlist