Cloudflare launches authenticated MoQ relay provisioning to enable production-ready, isolated media delivery

Cloudflare has introduced a new provisioning API for Media over QUIC (MoQ) that adds the missing pieces for production deployments: isolation boundaries and access controls between publishers and subscribers. After running a global, unauthenticated MoQ relay network for public testing, the company is now offering an authenticated control plane that lets applications create per-customer relay scopes and issue distinct credentials for each role—without deploying or scaling servers.

For IT professionals, hosting providers, and cloud architects, the update is significant because MoQ’s promise—CDN-like fan-out for publish/subscribe media over QUIC—has been constrained by operational and security requirements. With authenticated provisioning, MoQ becomes more realistic for real-time video, low-latency messaging, and streaming workloads where unauthorized access or cross-tenant data leakage can’t be tolerated.

Key developments

• MoQ relay provisioning API with isolation: Applications can create isolated delivery scopes across Cloudflare’s global network. Streams and namespaces are separated so one application’s traffic doesn’t mix with another’s.
• Role-based credentials (tokens): Cloudflare issues separate tokens for publishers and subscribers. Different permissions prevent subscribers from hijacking publishing access or escalating privileges.
• Draft-14 and draft-16 transport support: Cloudflare’s MoQ relays now support multiple IETF MoQ transport drafts, including draft-16 with authentication-relevant behavior.
• draft-16 features enabled for better session performance: PUBLISH allows relays to receive tracks before a viewer subscribes, reducing first-view latency. SUBSCRIBE_NAMESPACE lets subscribers request all announced tracks under a namespace, including tracks added later.
• Serverless operational model: The provisioning process creates configuration and credentials on top of Cloudflare’s existing network rather than starting dedicated VMs, containers, or processes.

Technical analysis: how authenticated MoQ relays change the architecture

MoQ basics: MoQ is a publish/subscribe protocol under development at the IETF. Publishers emit named tracks; subscribers request those tracks by name. Relays in between replicate tracks to all authorized subscribers, without needing to inspect or understand the media payload. Running MoQ over QUIC supports low latency and resilient transport behavior compared to traditional TCP-centric approaches.

Why unauthenticated relays weren’t enough: In the previous public preview model, any client could connect to a relay endpoint without role-specific authentication. That’s useful for protocol testing, but it breaks core production assumptions: you can’t reliably enforce who may publish, who may subscribe, or which publishers/subscribers belong to a given application session.

Isolation via provisioning scopes: Cloudflare’s new provisioning API creates an isolated scope—conceptually similar to a tenant boundary—so namespaces, tracks, and objects don’t collide across applications. This maps well to how infra teams think about multi-tenant hosting: instead of dedicating hardware, you allocate a protected logical boundary and attach policy.

Access control via tokens: A token is effectively a capability describing permitted operations on a given relay scope. By issuing separate credentials for publishers and subscribers, Cloudflare enforces a least-privilege model at session start. If a viewer presents only a subscribe-capable token, the relay can reject publish attempts even if the viewer can reach the same global anycast entry point.

Control plane vs data plane: The provisioning API manages resources (scopes) and credentials; it does not touch or mediate the media streams themselves. This separation matters operationally: it reduces complexity in the high-throughput data path and makes the system easier to reason about for incident response and security review.

Faster ramp-up with draft-16 features: Two draft-16 additions directly improve how quickly applications can start delivering media:

• PUBLISH: Traditionally, a first viewer subscription can require relay-to-publisher traversal before publishing begins. With PUBLISH, the relay can already be receiving a track before the first viewer arrives, lowering time-to-first-byte for the earliest session.
• SUBSCRIBE_NAMESPACE: Instead of requesting tracks individually, subscribers can subscribe to an entire namespace and automatically receive tracks announced under that namespace, including renditions or audio tracks added later in a live session. This aligns better with real-world media production workflows where track availability evolves during a broadcast.

Industry impact: what hosting providers and domain-adjacent businesses should expect

Hosting and CDN ecosystems: MoQ’s relay model resembles CDN fan-out, but with publish/subscribe semantics instead of request/response caching. Authenticated provisioning makes MoQ more compatible with enterprise delivery models where isolation and auditability matter. Hosting providers evaluating MoQ-style transport can now treat Cloudflare’s offering as a reference architecture: global anycast + control-plane provisioning + capability tokens.

Domain and identity implications (indirect but real): MoQ isn’t DNS, but access-control workflows often intersect with domain-driven identities. For example, organizations that rely on domain-based application boundaries (separate production vs staging subdomains, tenant-specific hostnames) typically need deterministic authorization mapping. The MoQ model’s scoped tokens can integrate into existing identity systems (even when the media plane is separate from HTTP/TLS web traffic), reducing the need to overload DNS policy or origin rules.

Operational adoption: System administrators and cloud teams benefit from a reduced infrastructure burden. Instead of provisioning and scaling relay processes and load balancing fleets, teams can create isolated delivery scopes and rotate/revoke tokens as part of their standard operational procedures.

Security posture improvements: The key practical shift is that role confusion becomes harder. A subscriber-only credential cannot typically be used to publish or alter delivery state. While tokens still require secure handling and lifecycle management, the overall threat surface is reduced compared to open relay endpoints.

Business and infrastructure implications

Lower time-to-market for real-time apps: Media teams building live video, interactive streaming, or ultra-low-latency messaging can focus on application logic rather than relay fleet engineering. The serverless scope provisioning model shortens the path from prototype to production.

Cost and scalability trade-offs: By avoiding per-tenant VM/container provisioning, organizations can reduce operational overhead and capacity planning complexity. However, architects should still model load patterns—MoQ traffic characteristics (track bitrate, session concurrency, namespace churn) can drive relay resource consumption. Even without customer-managed servers, performance budgets must be validated through load testing.

Token lifecycle governance: Cloud teams will need to treat MoQ tokens as sensitive credentials similar to API keys or signed session tokens. Best practices include short expiration windows, clear revocation workflows, and secure distribution to client applications. Because tokens are scoped, revocation for one relay scope should not disrupt unrelated tenants—an important factor for incident containment.

Integration planning: Enterprises using existing service meshes, identity providers, and monitoring stacks may need to extend observability into the MoQ control plane (provisioning events, token issuance/revocation) and correlate it with media performance metrics. The separation of control plane and data plane is beneficial, but it also means different telemetry streams.

Future outlook: toward standardized provisioning and richer security models

Standardization momentum: MoQ itself is an open IETF effort, and Cloudflare is documenting a provisioning model intended to be shared across implementations. While the API model is described as an Internet-Draft and may evolve, the direction is clear: reduce fragmentation between relay vendors and make it easier for client and relay implementations to interoperate.

Likely next improvements: Cloudflare indicates continued work on finer-grained permissioning and more flexible credential schemes (including discussions around signing keys). If successful, that could enable use cases such as per-track permissions, time-bound publishing rights for specific renditions, and stronger cryptographic attestations for credential delegation.

From beta to operational defaults: The provisioning API is currently available free during beta, but production plans will depend on stability guarantees, documented breaking-change policy, and maturity of tooling (SDKs, dashboards, and observability). Organizations that standardize early on MoQ capabilities may gain competitive advantage, but they should plan for iterative development.

Conclusion

Cloudflare’s authenticated MoQ relay provisioning API turns MoQ’s experimental promise into a model that can better satisfy real-world production constraints: tenant isolation, publisher/subscriber separation, and session-level access enforcement. By enabling draft-16 behaviors such as PUBLISH and SUBSCRIBE_NAMESPACE, the company is also addressing the performance and workflow realities of live media.

For infrastructure teams, the bigger takeaway is architectural: MoQ is emerging as an alternative media delivery primitive that borrows CDN-like scaling while retaining publish/subscribe semantics—now backed by a control plane that aligns with enterprise security expectations. As provisioning models and permissions evolve across the IETF ecosystem, MoQ could become a more interoperable foundation for low-latency streaming and real-time communications.