Protect Cloudflare WARP macOS Registrations With Secure Enclave Keys

Cloudflare has confirmed that Cloudflare One Client for macOS version 2026.6.822.0 supports hardware-backed device registration through the Secure Enclave. Confidence level: confirmed. The update matters for Zero Trust teams because copied registration tokens become less useful when API requests must be signed by a non-exportable hardware key.

Image: Official Cloudflare Docs changelog preview.

What changed

Cloudflare's June 29, 2026 changelog says the macOS Cloudflare One Client can now generate registration tokens in the Secure Enclave whenever it is available. The goal is stronger protection against device impersonation.

The supporting Cloudflare docs explain the mechanism. Hardware-backed registration binds a Cloudflare One Client registration to a private key stored in device hardware. The client then uses mutual TLS to prove that requests come from the device that created the registration.

This is not only a macOS UI update. It changes the trust model around device registration, which is why admins should treat it as a rollout task rather than a passive client upgrade.

Why this is early

The macOS general-availability changelog is fresh, and Cloudflare's hardware-backed registration docs were updated shortly before it. Cloudflare's community changelog mirror picked up the same change, but the primary facts come from Cloudflare's own changelog and docs.

The wider rollout still needs tenant-level planning. Cloudflare's docs say changing the setting invalidates the existing registration and forces affected devices to register again, so this is not a switch to flip during an unmanaged workday.

Key takeaways

• Cloudflare One Client for macOS 2026.6.822.0 adds Secure Enclave-backed registration.
• The feature is designed to reduce device impersonation after token extraction.
• Cloudflare uses hardware-backed keys and mTLS after registration.
• Enabling or disabling the setting forces devices to register again.
• Certificates are valid for 90 days, so long-offline devices may need re-registration.

Availability and access

Cloudflare lists the macOS release as version 2026.6.822.0. The docs describe hardware-backed registration as available for all Cloudflare One Client modes and all Zero Trust plans, with minimum WARP version 2026.6.0 for macOS, Windows, and Linux. iOS, Android, and ChromeOS are not listed as supported for this feature.

Admins configure the feature at the organization layer through hardware_backed_registration. Cloudflare says the setting should be applied consistently across organization configs, and affected devices must re-register when the setting changes.

Practical LinkLoot angle

This is a useful hardening step for teams that use Cloudflare Zero Trust as a control plane for remote work, internal apps, or admin access. It is especially relevant where device tokens could be copied from compromised endpoints and replayed elsewhere.

Before rolling it out, pair the change with your existing device posture rules and admin runbooks. If your team is also building AI operations or browser automation, this belongs in the same security checklist as service-token hygiene and least-privilege access. LinkLoot's AI agent tools guide is a useful place to audit automation entry points that depend on trusted devices.

What to verify before you act

• Confirm the exact Cloudflare One Client version deployed to managed macOS devices.
• Test re-registration on a small device group before enforcing it organization-wide.
• Check whether Windows and Linux endpoints need separate timing or user guidance.
• Plan for devices that may be offline longer than the 90-day certificate window.
• Document rollback steps, because disabling the setting also forces re-registration.

Source check

Confirmed by:

• Cloudflare's June 29 changelog confirms Secure Enclave-backed registration in Cloudflare One Client for macOS 2026.6.822.0.
• Cloudflare's hardware-backed registration docs explain the non-exportable key, mTLS flow, supported platforms, configuration layer, re-registration requirement, and 90-day certificate behavior.

Early signal / context:

• Cloudflare's community changelog mirror corroborates that the release note was picked up publicly.
• LinkLoot is treating future Windows, Linux, mobile, or policy-template changes as separate update triggers if Cloudflare posts them.