OAuth for all (blog.cloudflare.com)

Article summary

Cloudflare has introduced self-managed OAuth, allowing developers to create and manage their own OAuth clients for delegated access to the Cloudflare API. This move aims to make it easier for customers to build SaaS integrations, internal developer platforms, and agentic tools while giving users clearer consent, easier revocation, and more control over what an application can do. The introduction of self-managed OAuth is a result of the growing demand for delegated access to the Cloudflare API, particularly with the increasing use of agentic tools. Cloudflare's OAuth engine has been upgraded to support this new feature, with improvements to the consent experience, revocation, and security model.

Main themes

• Cloudflare OAuth
• API Access
• Security and Consent
• Developer Platform
• SaaS Integrations
• Delegated Access

What commenters say

• The introduction of self-managed OAuth is a positive development for security and usability, as it allows users to grant permissions to third-party services without having to share API keys.
• The complexity of OAuth is a necessary evil, driven by the need to protect sensitive information and prevent attacks.
• The use of OAuth can be a privacy nightmare, as OAuth providers can track which sites users log into and when.
• Some commenters believe that OAuth is overly complex and would prefer a simpler authentication method, such as API keys.
• Others argue that the complexity of OAuth is a result of design by committee and that it can be difficult to implement correctly.
• There is a concern that Cloudflare's expansion into new services may lead to the company abandoning its core offerings, including its free plan.
• Some commenters appreciate the transparency and detail provided by Cloudflare's engineering blog posts, while others find them mundane and lacking in substance.
• The implementation of OAuth can be flawed, and using libraries can expose users to bugs and security vulnerabilities.