Unlocking the Cloudflare app ecosystem with OAuth for all

Cloudflare completed a production migration to Hydra 2.X within three hours, maintaining OAuth service operation throughout. OAuth now allows all customers to create applications with scoped access to other customers' accounts via standard authorization flows. Previously, only a limited number of manually onboarded integrations had this capability.

OAuth replaces the awkward API tokens, which required users to manually create, copy, transmit, store, and revoke credentials outside the application's authorization flow. The user now sees which application requests access and which permissions it seeks. Cloudflare enhanced the OAuth dashboard to enable revocation and made application ownership more visible to minimize OAuth phishing risk.

A live revocation feature was added, allowing revoked applications to retain access until a user removes them. The migration involved changing Hydra's database migrations to perform index creation concurrently and using explicit column selections to avoid conflicts with older SDKs. After the migration, OAuth traffic showed improved performance and reliability, but an authorization-service cleanup job mistakenly purged OAuth policy data due to discrepancies between systems.

Operators should cover various aspects during a migration test plan, including concurrent refreshes, client retries, old and new token introspection, consent-session validity, downstream authorization decisions, and revocations issued during cutover.