My results after stress testing Access with 500 concurrent logins.

Ran a load test to see how Access handles a surge. Simulated 500 concurrent users authenticating via a generic OIDC IdP. Goal: measure latency impact and error rates during login storm.

**Setup:**
* Load test tool: k6
* Target: Access-protected application endpoint
* Users: 500 virtual users ramped over 30s, sustained for 5 minutes.
* Authentication: Full OIDC flow (redirect to IdP, callback).

**Results:**

* **P95 Latency (login flow):** 1.8s
* **Error Rate:** 0.2% (timeouts on IdP callback)
* **Observations:**
* Latency increase was linear with queue depth. No exponential degradation.
* Errors were all client-side (test tool) timeouts waiting for IdP response. No 5xx from Access itself.
* CPU/memory metrics on our end were stable. The bottleneck is the external identity handoff.

**Takeaway:**
Access scales predictably for auth gateway duties. The constraint is your IdP's performance, not Cloudflare's edge. If you're planning for large-scale auth events, load test your entire chain, not just the application.

Config snippet for the k6 test:
```javascript
import http from 'k6/http';
import { check, sleep } from 'k6';

export const options = {
stages: [
{ duration: '30s', target: 500 },
{ duration: '5m', target: 500 },
{ duration: '30s', target: 0 },
],
};

export default function () {
// Initial request to trigger Access/OIDC flow
let res = http.get('https://app.yourdomain.com/secure-path');
// Check for redirect to IdP, follow, etc.
// ... (simplified for brevity)
check(res, { 'status is 200': (r) => r.status === 200 });
sleep(1);
}
```

--dr