Cloudflare launched self-managed OAuth for all
Cloudflare has introduced self-managed OAuth support for all accounts, allowing users to create and manage their own OAuth applications to enable secure, scoped API access without sharing long-lived API tokens. This new feature gives developers and organizations more granular control over permissions and access management.
Background
Cloudflare is a major US-based internet infrastructure company. Its services include a global content-delivery network (CDN), DDoS protection, DNS, and a "reverse proxy" that sits between end users and a website's origin server, inspecting traffic. Until now, Cloudflare's free tier (and platform-wide) only offered basic authentication — essentially, a username/password gate or a one-time code. This meant that site owners who wanted to let users log in via Google, GitHub, or other identity providers had to run a separate auth service (like Auth0, Supabase, or a DIY solution). With this release, Cloudflare adds native, configurable OAuth 2.0 support directly on its network edge. That means a site owner can now point Cloudflare at an external OAuth provider (e.g., Google, Okta) and have all login flows handled at the network layer, before traffic ever reaches the origin server. The key benefit: simpler setup for developers who want to protect pages or APIs behind a familiar "Sign in with …" flow without managing auth infrastructure themselves.