# Cloudflare Tunnel: 50,000 routes and Tunnels for Platforms

> Cloudflare raised Tunnel routes to 50,000 per account on 16 October 2026 and launched Tunnels for Platforms at $4.50 a tunnel. Limits, setup and gotchas.

By Boris Tane, Founder of Polylane · Published October 17, 2026 · Updated October 18, 2026 · 11 min read
Canonical: https://polylane.com/learn/deployment-safety/cloudflare-tunnel-50000-routes-limit-tunnels-for-platforms/

On 16 October 2026 Cloudflare raised the default route limit to 50,000 per account, up from 1,000. The limit covers CIDR and hostname routes for Cloudflare Tunnel and Cloudflare Mesh, and every account gets it with nothing to do. Cloudflare also launched Tunnels for Platforms: each account still includes 1,000 tunnels, and you can now buy more at $4.50 per tunnel per month, so you can run one tunnel per device, customer or environment in a single account.

Cloudflare announced two changes to Cloudflare Tunnel on 16 October 2026. First, the default limit for routes went up from 1,000 to 50,000 per account. That limit covers CIDR routes and hostname routes for private network traffic, and Cloudflare Tunnel and Cloudflare Mesh share it. Every account got the new limit automatically. Second, **Tunnels for Platforms** lets one account run more than its 1,000 included tunnels. Each extra tunnel costs $4.50 a month, and Enterprise customers can arrange committed or usage-based pricing.

If you connect private networks and kept hitting the old route ceiling, you don't need to do anything. If you build a platform that gives every customer, device or preview environment its own tunnel, you can now keep the whole fleet in one account. You buy capacity from the dashboard, and the `cloudflared` daemon, the API and the dashboard all work the same way they did before.

## What Tunnels for Platforms is

A Cloudflare Tunnel connects your servers to Cloudflare without giving them a publicly routable IP address. A small daemon called `cloudflared` runs in your infrastructure and opens outbound-only connections to Cloudflare's network. Traffic then reaches your services through those connections. Each tunnel is a persistent object in your Cloudflare account, and one or more `cloudflared` replicas connect to it.

Tunnels for Platforms is a paid subscription that raises the number of tunnels a single account can hold. Without it, an account can have 1,000 tunnels. With it, the limit is 1,000 plus however many extra tunnels you buy. It adds nothing new to the tunnels themselves. They run the same daemon and use the same API. What it gives you is the ability to have one tunnel for every customer, device or environment without spreading them across several Cloudflare accounts.

The route limit is a separate thing. A route tells Cloudflare which tunnel should carry private network traffic for an IP range or a private hostname. The 50,000 figure caps how many of those an account can hold, and it is the default for every account.

## What Cloudflare changed on 16 October 2026

**50,000 routes per account by default.** Up from 1,000. CIDR and hostname routes, shared by Tunnel and Mesh.

**1,000 tunnels included in every account.** Included at no cost. Tunnels for Platforms adds more.

**$4.50 per additional tunnel per month.** Cloudflare's list price for tunnels beyond the first 1,000.

The Cloudflare changelog post lists four products: Cloudflare Tunnel, Cloudflare Tunnel for SASE, Cloudflare Mesh and Cloudflare One. Cloudflare updated the account limits page, the routing page and the new Tunnels for Platforms page on the same day.

**Figure 1. Cloudflare default routes per account, before and after 16 October 2026**

| Metric | Before | From 16 October 2026 |
| --- | ---: | ---: |
| Routes per account (CIDR plus hostname) (routes) | 1,000 | 50,000 |

## Routes, published applications and tunnels have separate limits

Most of the confusion around this announcement comes from three different limits that people group under one word. Find out which one you're actually hitting before you change anything.

### Routes: private network traffic, 50,000 per account

A route sends private network traffic to a tunnel. A CIDR route such as `172.16.0.0/16` sends traffic for that IP range down a given tunnel. A hostname route does the same thing for a private hostname. This is the limit that went from 1,000 to 50,000. One budget covers the whole account, and Cloudflare Tunnel and Cloudflare Mesh draw from it together.

### Published applications: bounded by a 1 MB configuration per tunnel

A published application maps a public hostname, such as `app.example.com`, to a local service, such as `http://localhost:8080`. Cloudflare's docs say plainly that published applications are a different thing from routes, and they don't count toward the route limit. Their limit is set per tunnel by configuration size. A remotely managed tunnel's configuration can be up to 1 MB. Each published application adds one ingress rule, and a typical rule takes 100 to 200 bytes. That works out to roughly 5,000 to 10,000 published applications per tunnel. Long hostnames, paths and many origin parameters make each rule bigger, so the tunnel holds fewer of them.

### Tunnels: 1,000 included, more with Tunnels for Platforms

Every account includes 1,000 tunnels at no cost. Tunnels for Platforms changes only this number. The other Tunnel limits stay as they were: 1,000 virtual networks per account, 25 active `cloudflared` replicas per tunnel, and the configuration size cap for published applications. Mesh keeps its own limit of 50 Mesh nodes per account.

```mermaid alt="Decision flow for which Cloudflare Tunnel limit applies: published app config size, routes or tunnel count"
graph TB
    A[What are you adding?] --> B{Public hostnames on a tunnel?}
    B -->|yes| C[Per tunnel 1 MB config limit]
    C --> D[Spread apps across more tunnels]
    B -->|no| E{Private CIDR or hostname routes?}
    E -->|yes| F[Account limit now 50,000 routes]
    E -->|no| G{More than 1,000 tunnels?}
    G -->|yes| H[Buy Tunnels for Platforms capacity]
    G -->|no| I[Included, nothing to buy]
    style F fill:#d1fae5,stroke:#6ee7b7,color:#065f46
    style H fill:#d1fae5,stroke:#6ee7b7,color:#065f46
```

These limits interact. If you need to publish more applications than one tunnel's configuration holds, the docs say to distribute them across multiple tunnels. That uses up your tunnel count, which brings you back to Tunnels for Platforms once you pass 1,000.

## Who Tunnels for Platforms is built for

Cloudflare describes the product for teams that create one tunnel per device, per end customer or per environment. It names four groups:

- **SaaS providers** that give each end customer a tunnel to reach systems in that customer's private network or on-premises environment.
- **IoT and device makers** that give each deployed camera, router, sensor or industrial controller its own tunnel.
- **Developer tools and ephemeral environments** that create short-lived tunnels for local development, CI/CD pipelines and preview environments.
- **AI and agent platforms** that connect each customer's AI agents and MCP servers to private resources through that customer's own tunnel.

Before this change, a fleet that grew past 1,000 tunnels had to be split across several Cloudflare accounts. The Tunnels for Platforms page names that as the problem it removes: you add capacity as the fleet grows and keep it in one account. Nothing changes for tunnels you already run. The docs state that no changes to your tunnels or `cloudflared` deployments are required.

## Checking how close your account is to each limit

Start by finding out which limit you're closest to.

1. Open the Cloudflare dashboard and go to **Networking** > **Tunnels**. The **Usage** card shows your tunnel limit. This is also where the purchase button lives.
2. Count your private network routes. Routes live under the account's `teamnet/routes` endpoint, the same one you `POST` to when you create a route. A `GET` on it lists them:

```bash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes" \
  --request GET \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"
```

3. For each tunnel that serves many public hostnames, check the size of its configuration. If you're adding hostnames one tunnel at a time and getting close to thousands per tunnel, plan to split them before you reach the 1 MB cap.
4. If you also run Cloudflare Mesh, add its CIDR and hostname routes to your count. Tunnel and Mesh share the 50,000 budget.

## Buying tunnels beyond the first 1,000

The purchase happens in the dashboard:

1. Go to **Networking** > **Tunnels**.
2. In the **Usage** card, select **Buy more tunnels**.
3. Enter the number of additional tunnels you need.
4. Review the order summary and payment method, then select **Activate**.

The new limit shows up in the **Usage** card within a few minutes. Your limit equals 1,000 plus the number of tunnels you bought. Enterprise customers who want committed capacity or usage-based billing should go through their account team.

You can work out the monthly bill before you buy. Every tunnel that exists in the account counts, including inactive tunnels:

```bash
TUNNELS=2500      # tunnels you expect to exist, active or not
INCLUDED=1000     # included in every account
EXTRA=$(( TUNNELS > INCLUDED ? TUNNELS - INCLUDED : 0 ))
echo "Additional tunnels: $EXTRA"
echo "Monthly cost (USD): $(echo "$EXTRA * 4.50" | bc)"
```

### Changing or cancelling the subscription

Go to **Manage Account** > **Billing** > **Subscriptions** and find **Tunnels for Platforms**. You can raise or lower the number of extra tunnels, or cancel, at any time. Changing the number never deletes a tunnel. If the new limit is below the number of tunnels you have, existing tunnels keep working. Cloudflare blocks new tunnel creation until you delete enough tunnels or buy more capacity.

## Creating one tunnel per customer through the API

No one creates thousands of tunnels by clicking. The docs recommend running the tunnel lifecycle through the Cloudflare API or Terraform. Here's the API flow for one customer's tunnel, using a remotely managed tunnel.

1. **Create an API token** with Account > Cloudflare Tunnel > Edit, plus Zone > DNS > Edit if you'll publish hostnames.
2. **Create the tunnel with a deterministic name.** Cloudflare suggests a pattern like `tunnel-<CUSTOMER_ID>-<REGION>`:

```bash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel" \
  --request POST \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "name": "tunnel-cust4821-eu",
    "config_src": "cloudflare"
  }'
```

The response contains an `id` and a `token`. Store both against the customer record.

3. **Attach what the tunnel reaches.** For a customer's private network, add a route. This uses one of your 50,000 routes:

```bash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes" \
  --request POST \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "network": "172.16.0.0/16",
    "tunnel_id": "'"$TUNNEL_ID"'",
    "comment": "cust4821 private network"
  }'
```

For a public hostname, `PUT` an ingress configuration to `cfd_tunnel/$TUNNEL_ID/configurations` that ends with a catch-all rule such as `http_status:404`, then create a proxied CNAME pointing to `<TUNNEL_ID>.cfargotunnel.com`.

4. **Run `cloudflared` at the customer's site** with the token:

```bash
docker run cloudflare/cloudflared:latest tunnel --no-autoupdate run --token "$TUNNEL_TOKEN"
```

5. **Verify it** with a `GET` on `cfd_tunnel/$TUNNEL_ID`. Cloudflare's guide says a healthy tunnel shows four connections to its network and `"status": "healthy"`.

```mermaid alt="Lifecycle of a per-customer Cloudflare tunnel: idempotent create, run, reconcile and delete to free capacity"
graph TB
    A[New customer or device] --> B{Tunnel with this name exists?}
    B -->|yes| C[Reuse the existing tunnel]
    B -->|no| D[Create tunnel through the API]
    C --> E[Run cloudflared with the token]
    D --> E
    E --> F[Reconcile against your records]
    F --> G{Owner still exists?}
    G -->|yes| F
    G -->|no| H[Delete tunnel to free capacity]
    style H fill:#d1fae5,stroke:#6ee7b7,color:#065f46
```

Creating a tunnel takes a few seconds. If customers expect a tunnel the moment they sign up, Cloudflare suggests keeping a pool of tunnels created ahead of time and refilling it in the background. Pool tunnels count toward your limit and your bill like any other tunnel, so size the pool with that in mind.

## What happens when the account hits its tunnel limit

The limit only applies when you create a tunnel. When the account reaches it, existing tunnels and their connections carry on as normal. Requests to create a new tunnel fail until you delete one or raise the limit. That makes the failure easy to miss: production traffic looks fine while onboarding quietly breaks for the next customer or device. Handle a failed create in your provisioning code as a capacity problem that someone needs to know about, and alert on it the same way you'd alert on a failed deploy.

## Mistakes that cost money or break onboarding at fleet scale

**Paying for tunnels nobody uses.** Every tunnel in the account counts toward the limit and the bill, including tunnels with no connected replicas. Stopping `cloudflared` doesn't delete a tunnel. The fix is a reconcile job: compare the tunnels in the account with your own records, and delete any tunnel whose device, customer or environment is gone. The tunnel connections API shows which tunnels have no active connections:

```bash
curl -s "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID" \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  | jq '.result | {name, status, connections: (.connections | length)}'
```

Ephemeral environments leak tunnels fastest. Tie deletion to the same pipeline step that tears down the preview environment.

**Duplicate tunnels from retries.** A create request can time out after Cloudflare has already made the tunnel. If you retry blindly, you end up with two. Use unique, deterministic names, and check whether a tunnel with that name already exists before you retry.

**Bursting the API.** Bulk provisioning hits the Cloudflare API rate limits. Retry `429` and `5xx` responses with exponential backoff and random jitter. Queue create and delete operations and send them at a steady rate.

**One replica per tunnel in production.** Cloudflare recommends at least two `cloudflared` replicas per tunnel for high availability. The cap is 25 active replicas per tunnel. Keep in mind that a load balancer treats all replicas of one tunnel UUID as a single endpoint. If you need traffic steering or session affinity across hosts, give each host its own tunnel, which also adds to your tunnel count.

**Counting published applications as routes.** Teams that publish thousands of public hostnames sometimes read this announcement as their fix. Public hostnames were never part of the route limit. Their ceiling is the 1 MB configuration per tunnel, and the fix is more tunnels.

**Forgetting that Mesh shares the route budget.** If you run Cloudflare Tunnel and Cloudflare Mesh in the same account, both use the same 50,000 routes. Plan route growth for both together.

**Leaving DNS records pointing at stopped tunnels.** If a tunnel stops, its DNS record is not deleted, and visitors see a `1016` error. When you remove a customer's tunnel, remove its records too.

## Watching a Cloudflare tunnel fleet with Polylane

Polylane detects production issues and fixes them by opening pull requests. It connects to Cloudflare, so when a Worker behind a tunnel breaks, it works out why, and the fix arrives ready for your team's normal review.

Running on Cloudflare? See [how Polylane monitors Cloudflare in production](https://polylane.com/for/cloudflare/).

## Common questions

**When did Cloudflare raise the Tunnel route limit to 50,000?**

Cloudflare announced it in its changelog on 16 October 2026. The default went from 1,000 to 50,000 routes per account and applied to every account automatically. You don't need to request it or change any configuration.

**Do public hostnames count toward the 50,000 route limit?**

No. Published applications (public hostnames) don't count as routes. Their limit is per tunnel and depends on configuration size: up to 1 MB, which is roughly 5,000 to 10,000 published applications depending on how long each ingress rule is.

**How much does Tunnels for Platforms cost?**

The first 1,000 tunnels in every account are included at no cost. Each additional tunnel costs $4.50 per month. Enterprise customers can contact their account team for committed capacity or usage-based billing.

**Do inactive tunnels count toward my tunnel limit?**

Yes. Every tunnel that exists in the account counts, including inactive tunnels and tunnels with no connected cloudflared replicas. Disconnecting cloudflared doesn't delete the tunnel, so you need to delete unused tunnels through the API to free capacity.

**What happens if I reach my tunnel limit?**

Existing tunnels and their connections keep working. New tunnel creation fails until you delete a tunnel or buy more capacity under Networking > Tunnels > Buy more tunnels. The same applies if you lower your subscription below the number of tunnels you have.

**Do I need to change cloudflared to use Tunnels for Platforms?**

No. It uses the same cloudflared daemon, API and dashboard as every other tunnel, and Cloudflare states that no changes to your tunnels or cloudflared deployments are required. Only the number of tunnels allowed per account changes.

**Is the 50,000 route limit shared with Cloudflare Mesh?**

Yes. The account limits page lists 50,000 CIDR plus hostname routes per account, shared between Cloudflare Tunnel and Cloudflare Mesh. Mesh also has its own limit of 50 Mesh nodes per account.

## Sources

- [50,000 routes per account and Tunnels for Platforms (Cloudflare changelog)](https://developers.cloudflare.com/changelog/post/2026-10-16-tunnels-for-platforms-and-50k-routes/)
- [Tunnels for Platforms · Cloudflare Docs](https://developers.cloudflare.com/tunnel/features/tunnels-for-platforms/)
- [Account limits · Cloudflare One docs](https://developers.cloudflare.com/cloudflare-one/account-limits/)
- [Routing · Cloudflare Tunnel docs](https://developers.cloudflare.com/tunnel/concepts/routing/#published-application-limits)
- [Cloudflare Tunnel · Cloudflare One docs](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/)
- [Create a tunnel (API) · Cloudflare One docs](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel-api/)
- [List tunnel routes · Cloudflare API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/routes/methods/list/)
- [AI monitoring and incident response for Cloudflare · Polylane](https://polylane.com/for/cloudflare/)

## About the author

Boris Tane is the founder of Polylane. He previously founded Baselime, observability for the future of the cloud, which Cloudflare acquired. At Cloudflare he built and led the Workers observability team.

## Related

- [Cloudflare Containers agent sandboxes: startup and setup](https://polylane.com/learn/deployment-safety/cloudflare-containers-agent-sandboxes-startup-time/): Cloudflare Containers now start agent sandboxes in a median 648 ms. Set up the durable_object policy, runtime images and snapshots, and know the limits.
- [What is change intelligence? A production safety guide](https://polylane.com/learn/deployment-safety/what-is-change-intelligence/): What is change intelligence? Learn how deploys, config, flags, infrastructure and dependency changes connect to incidents, using tools you already have.
- [How to correlate incidents with deploys using evidence](https://polylane.com/learn/deployment-safety/how-to-correlate-incidents-with-deploys/): Learn how to correlate incidents with deploys using release markers, metrics, logs and verified GitHub, Vercel, Cloudflare and Kubernetes change events.
- [How to attach Vercel Sandbox to a Secure Compute network](https://polylane.com/learn/deployment-safety/vercel-sandbox-secure-compute-network-attachment/): Vercel Sandbox now supports Secure Compute. Attach a sandbox to your network for static egress IPs and VPC peering, with steps, costs and gotchas.
- [Workers Issues: route Cloudflare errors to coding agents](https://polylane.com/learn/incident-response/cloudflare-workers-issues-error-monitoring-agents/): Cloudflare's new Workers Issues groups exceptions and 5xx errors and sends them to Claude Code, Cursor, Devin or a webhook. Setup, automations and limits.

Get started with one command: `curl -fsSL https://polylane.com/setup | bash` installs the CLI, connects your coding agents, and creates the account.