LayerV vs Cloudflare Access
One link per person, instead of one more rule in a policy.
Cloudflare Access protects an application with a policy; people outside your identity provider can sign in with a one-time PIN emailed to an address the policy allows. LayerV skips the policy edit: you issue an access link for one resource, set its expiry and use limit, and revoke that one link through the API when the work is done.
Facts checked October 7, 2026 against each vendor’s documentation.
Cloudflare Access is a policy layer: you define who may reach an application, and Cloudflare checks each request against that list. LayerV is a grant layer: publish the resource once, then issue an access link to each person or agent who needs it, for as long as they need it. Both keep the origin private behind an outbound connection.
Share one app from the command line
qurl publish http://127.0.0.1:3000
qurl share <CRID>Architectural Difference
Cloudflare Tunnel connects outbound from your origin, so no inbound port is needed, and Access decides who reaches the app. Publishing an application on a public hostname through a tunnel starts with adding your domain to Cloudflare. Access policies then name who is allowed, such as emails, email domains, identity-provider groups, or service tokens for machines. Someone outside your identity provider can sign in with a one-time PIN: Access emails a code, valid for 10 minutes, to an address the policy allows. Access then sends the origin a signed Cf-Access-Jwt-Assertion header that identifies the user.
LayerV starts with the resource. Publish it through an outbound connector, or with qurl publish for an app on your machine, then create an access link when someone needs it. The recipient opens the link in a browser with no LayerV account or CLI. Expiry, use limits, and revocation belong to each link, so ending one person’s access leaves everyone else’s alone, and there is no allow list to edit.
A Cryptographic Resource ID (CRID) gives the resource a cryptographic identity independent of its network address. Who can open the resource is a separate choice, made when it is published. A private resource opens only for its publisher’s devices and for the people and devices the publisher allowed, so the CRID of a private resource is safe to send to anyone. A public resource can be opened by anyone who has its CRID. A qURL carries a separate, signed grant for that resource; a compatible opener verifies it before requesting access. LayerV checks authorization before opening the protected origin connection.
Cloudflare Access tells your app who each user is. A LayerV link grants access to whoever holds it and sends your app no identity, so keep your app’s own sign-in wherever it needs to know the user.
Feature Comparison
| Feature | LayerV | Cloudflare Access |
|---|---|---|
| Origin connection | Outbound connector; no inbound port | Cloudflare Tunnel connects outbound; no inbound port |
| What a grant reaches | One published resource per access link | An application, for everyone its Access policy allows |
| Recipient setup | A browser, with no LayerV account or client | Browser sign-in through your identity provider or an emailed one-time PIN |
| Lifetime and single use | Set on each link: expiry and use limit | Policies stay until you change them; service tokens expire after the duration you set |
| Revoking one recipient | Revoke that link through the API; other links keep working | Remove their policy allowance or IdP access, and revoke active sessions |
| Identity sent to the app | None; keep your app’s own sign-in | A signed Cf-Access-Jwt-Assertion header that includes the user’s email |
| Machine access | Issue and open links with the SDK or API | Service tokens sent as CF-Access-Client-Id and CF-Access-Client-Secret headers |
| Setup before the first share | Publish the resource with the CLI or a connector | A Cloudflare account, your domain added to Cloudflare, a tunnel, and an Access application |
Which one to use
Choose LayerV to
Give a contractor access to an internal app, send a customer a private preview, or let an agent reach an API for a task. LayerV brings these workflows together around one published resource and fresh access links. Your app stays on its own host; you control the access window and can withdraw individual links.
When Cloudflare is the better choice
Choose Cloudflare Access when the people who need the app are already in your identity provider and need standing access, or when your app should learn who each user is from a signed header. If your domain already runs on Cloudflare, adding an Access policy to an existing tunnel is a small step.
Frequently Asked Questions
What does the LayerV free tier include?
The free tier includes 10 active protected resources, unlimited qURLs per resource, and 10 GiB/month of data transfer (request + response). Contact the team about larger deployments and support requirements.
Can someone outside our identity provider use Cloudflare Access?
Yes, with a one-time PIN: Access emails a code, valid for 10 minutes, to an address your policy allows, and they paste it into the login page. They still need to be named in the policy. A LayerV recipient needs only the link you send.
What does LayerV add beyond a tunnel?
An outbound tunnel supplies transport. LayerV combines that private path with cryptographic resource identity, signed access grants, and authorization before the origin connection opens. Your code can issue and revoke access for one task without giving the recipient general network access. ngrok and Cloudflare also offer authentication and policy controls; outbound connectivity alone is not the distinction.
How do I end one person’s access?
Revoke their link through the API (DELETE /v1/resources/{id}/qurls/{qurl_id}). The resource and every other link keep working, so nobody else loses access. Revoking the resource ends all of its links.
How do recipients use a LayerV link?
A browser recipient opens the link without a LayerV account or CLI. Software uses a compatible SDK or the documented token-resolution API. Your application can retain its own sign-in and permissions.