ST-2026-118 · Authentication & identity
Cloudflare introduces self-managed OAuth clients for API integrations
Cloudflare developers can create OAuth applications with selected scopes and explicit user consent as an alternative to long-lived API tokens.
Previous state
Third-party Cloudflare API integrations primarily relied on long-lived API tokens rather than developer-managed OAuth application registrations.
Current state
Developers can create and manage OAuth clients, select limited scopes and request explicit consent; applications start private and require prerequisites plus domain verification before public visibility.
Affected users
Who needs to care
Developers building third-party applications that access Cloudflare accounts on behalf of users.
Required response
What to do
Register a client, minimise scopes, implement consent and redirect handling and complete client-domain verification before requesting public visibility.
Evidence boundary
What the source does not prove
API-token authentication is not retired. New clients are private by default and are not automatically available to all Cloudflare users.
Lifecycle history
Dated event sequence
- Self-managed OAuth launched
Cloudflare added developer-managed OAuth clients with private and public visibility states.
Evidence ledger
First-party sources
- 01Cloudflare Developers — Introducing self-managed OAuth clients
Official authentication changelog · 2026-06-03
Open official source ↗