Cloudflare opens OAuth to all developers

Self-managed OAuth is now open to every developer on Cloudflare, the company said in a post published on June 24. Customers can create and manage their own OAuth clients for delegated access to the Cloudflare API, instead of going through a small number of manually onboarded integrations.

From API tokens to delegated access

OAuth is not new at Cloudflare: Wrangler, its developer CLI, and partner integrations such as PlanetScale have used it for years. But third-party OAuth was limited to hand-onboarded partners, so developers building their own tools had to rely on API tokens, which the company calls harder to manage and a poor fit for delegated flows.

With self-managed OAuth, an application runs a standard flow in which a customer grants scoped access directly. Cloudflare says this eases the building of SaaS integrations, internal developer platforms and agentic tools, and gives users clearer consent and easier revocation. Earlier this year it updated the consent screen to show which application is asking for access and what permissions it will get, added revocation controls to the dashboard, and made app ownership more visible to help prevent OAuth phishing.

Rebuilding the engine underneath

Opening OAuth to everyone required a major upgrade of the engine underneath — Hydra, an open-source OAuth server Cloudflare deployed years ago. Instead of one large jump, the team planned two sequential upgrades, first to the latest 1.X release and then to 2.X, after finding that even the smaller step would lock critical tables during schema migrations.

For the 2.X upgrade an in-place migration was ruled out, so Cloudflare chose a blue-green approach: migrations ran against a copy of the production database while writes stayed enabled to avoid an outage. Token lifetimes were extended to multiple hours to cut new writes, and every revocation was captured in a queue built on Cloudflare Queues so it could be replayed after the cutover — a safeguard against restoring access that users had revoked. The production migration took about three hours in a low-traffic window.

The cutover was not entirely clean. After the 1.X step, refresh token errors rose because the new version invalidated a whole token chain whenever a refresh token was reused, hitting high-volume clients such as Wrangler and MCP tools; Cloudflare added refresh token coalescing to the Worker that routes OAuth traffic. After the 2.X cutover, a cleanup job in the authorization service began purging valid policy data, traced to a migration that marked some valid sessions as invalid; the company restored the data.

The results

Cloudflare says OAuth traffic has stayed stable since the upgrade, with production now on the same foundation its newer OAuth APIs were validated against in staging. The migration updated 132.5 million rows and inserted 114.7 million, and Hydra's average API P95 latency fell 45 percent, from 185 ms to 101 ms. Any Cloudflare customer can now create an OAuth application from the dashboard.