Early Hints for SaaS

Early Hints allows the browser to begin loading resources while the origin server is compiling the full response. This improves webpage’s loading speed for the end user. As a SaaS provider, you may prioritize speed for some of your custom hostnames. Using custom metadata, you can enable Early Hints per custom hostname.

Prerequisites

Before you can employ Early Hints for SaaS, you need to create a custom hostname. Review Get Started with Cloudflare for SaaS if you have not already done so.

Enable Early Hints per custom hostname via the API

Locate your zone ID, available in the Cloudflare dashboard.
Locate your Authentication Key on the API Tokens ↗︎ page, under Global API Key.
If you are creating a new custom hostname, make an API call such as the example below, specifying "early_hints": "on":

Required API token permissions

At least one of the following token permissions is required:

SSL and Certificates Write

Create Custom Hostnamebash

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/custom_hostnames" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"hostname": "<CUSTOM_HOSTNAME>",
		"ssl": {
				"method": "http",
				"type": "dv",
				"settings": {
						"http2": "on",
						"min_tls_version": "1.2",
						"tls_1_3": "on",
						"early_hints": "on"
				},
				"bundle_method": "ubiquitous",
				"wildcard": false
		}
	}'

For an existing custom hostname, use a GET call to retrieve its id and current ssl.settings values:

Required API token permissions

At least one of the following token permissions is required:

SSL and Certificates Write
SSL and Certificates Read

List Custom Hostnamesbash

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/custom_hostnames?hostname=%7Bhostname%7D" \
	--request GET \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

For example, the response may contain the following settings:

{
  "ssl": {
    "settings": {
      "ciphers": [
        "ECDHE-ECDSA-AES128-GCM-SHA256",
        "ECDHE-RSA-AES128-GCM-SHA256"
      ],
      "early_hints": "off",
      "http2": "on",
      "min_tls_version": "1.2",
      "tls_1_3": "on"
    }
  }
}

Copy the complete ssl.settings object from the response. Change only early_hints to on, then make a PATCH call:

Required API token permissions

At least one of the following token permissions is required:

SSL and Certificates Write

Edit Custom Hostnamebash

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/custom_hostnames/$CUSTOM_HOSTNAME_ID" \
	--request PATCH \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"ssl": {
				"settings": {
						"ciphers": [
								"ECDHE-ECDSA-AES128-GCM-SHA256",
								"ECDHE-RSA-AES128-GCM-SHA256"
						],
						"early_hints": "on",
						"http2": "on",
						"min_tls_version": "1.2",
						"tls_1_3": "on"
				}
		}
	}'

A PATCH request replaces the existing ssl.settings object. The example copies every setting from the sample response. Copy the values from your response, and omit settings that were not present.