Cloudflare Launches Self‑Managed OAuth for All Developers
Enable self‑managed OAuth to allow delegated access for your integrations.
Configure OAuth clients, test delegated flows, and monitor token revocation.
Summary
Cloudflare announced self‑managed OAuth on June 3 2026, enabling developers to create and manage their own OAuth clients for delegated access to the Cloudflare API. Prior to this, third‑party OAuth was limited to a handful of manually onboarded integrations, forcing developers to rely on API tokens that are harder to manage and unsuitable for delegated flows.
The new feature expands the OAuth consent experience, adds revocation in the dashboard, and makes app ownership visible to prevent phishing attacks. Underpinning the rollout is a major upgrade of the Hydra OAuth engine, moving from the legacy 0.X version to the latest 1.X release and planning a subsequent 2.X upgrade.
The 1.X upgrade required rewriting SQL migrations with CREATE INDEX CONCURRENTLY and selecting explicit columns to avoid SELECT * deserialization issues, and a blue‑green strategy was devised for the 2.X upgrade to minimize downtime. The upgrade plan includes a revocation replay queue using Cloudflare Queues, a copy‑and‑restore of the production database, targeted data cleanup, and simultaneous cutovers of Hydra and two internal systems.
After the 1.X cutover, refresh‑token errors increased due to stricter invalidation, which was mitigated by adding refresh‑token coalescing in the Worker and leveraging Hydra’s configurable grace period in 2.X. The final 2.X upgrade ran for roughly three hours, with careful monitoring and validation, and the new OAuth engine now supports self‑managed clients for all customers.
Key changes
- Self‑managed OAuth clients now available for all Cloudflare customers, enabling delegated access to the API.
- Consent experience updated with clearer app names, permissions, and revocation in the dashboard.
- Hydra OAuth engine upgraded to 1.X, rewriting migrations with CREATE INDEX CONCURRENTLY and explicit column selection.
- Blue‑green upgrade strategy planned for 2.X, including revocation replay queue, database copy, and targeted data cleanup.
- Refresh‑token errors mitigated by adding token coalescing and Hydra’s refresh‑token grace period.
- Revocation replay queue built with Cloudflare Queues to preserve revocation events during upgrade.
- Upgrade window chosen during lowest request volume to minimize lost token writes.
- The new OAuth engine now supports self‑managed clients for all customers.