Hey everyone, I've been living in the Cloudflare Access dashboard for the better part of a year now for a few side projects and my main SaaS gig. Like many of you, I was initially thrilled by the promise—a sleek, Zero Trust gateway for my internal tools without the VPN hassle. The pricing *seemed* straightforward: $7 per user per month. But after digging into the analytics and scaling up, I've hit what I’m calling a quiet pricing trap that isn't immediately obvious.
The core of it is this: **how does Cloudflare define an "active user"?** It's not as simple as "people who logged in this month." In my experience, it's any unique user who authenticated *to any application* behind Access in a given month. This becomes a massive multiplier if you have multiple tools (like a staging site, a database admin panel, and an internal wiki) and team members who need all of them.
Here’s what ballooned my bill unexpectedly:
* We have 10 core team members. At $7 each, that's $70/month. Simple.
* But we also have 5 contractors who need access to just one specific app (our error dashboard). That's 5 more "users."
* Then, we have a separate app for our beta testers. Even if they only log in once a month, that's 50+ "active users" added to the count.
* **Suddenly,** my bill isn't based on 10 team members. It's based on 65+ identities, pushing me well over $455/month.
The dashboard's "Active Users" report was the wake-up call. It counts every single distinct email, including those from Google OAuth, GitHub, etc. There's no built-in way (that I've found) to say "this person is a core user, these are external, guest users." They're all just... users.
So, my question to the community is: **How are you managing this?** Have you found clever ways to structure apps or use service tokens to keep the "user" count down? Or have you accepted that the true cost is "per identity per month" and budgeted accordingly?
I'm still a huge fan of the product for its ease and security, but the pricing model feels at odds with how modern, distributed teams actually work. For a small startup, this can become a significant line item very quickly. Would love to hear your stories and any workflow hacks you've developed.
—ec
Test, measure, repeat
> how does Cloudflare define an "active user"?
They don't, clearly enough. That's the point. It's in the fine print, where all the actual pricing lives. The multiplier you're seeing is the whole model. Every app is a separate charge, so of course they count per-auth.
Wait until you see what happens with SSO integrations you didn't fully scope. The bill gets creative.
Your stack is too complicated.
That's a perfect breakdown of the exact scenario that makes their billing so unpredictable. Your contractor example hits the nail on the head. We ran into something similar with our support team accessing a single logging portal. It forced us to do a weird consolidation of tools behind one app just to avoid counting the same person multiple times.
It turns your clean, per-app security model into a cost puzzle you have to solve. Have you looked at the monthly active user report in the dashboard? Seeing that list really drives it home.
That's not a pricing trap, that's just how it works. You bought a per-user gateway and are surprised it counts users? The real trap was thinking $7 was the total cost.
Anyone who's run this at scale knows you need to proxy everything behind a single "portal" app to avoid the multiplier. It defeats the purpose of their clean app-level security, but that's the vendor tax.
Just my two cents.