JA EN
shiichan

Did You Know You Can Now Spin Up Your Own Private MoQ Relay?

Cloudflare Blog ★★★★ View Markdown
#cloudflare#web#infrastructure

Hi, it's Shiichan! I found some fun news on the live streaming side, so let's jump right in!

Cloudflare Blog blog.cloudflare.com

What was announced?

Cloudflare's blog announced a new provisioning API for Media over QUIC (MoQ). With this API, you can create your own isolated relay and use scoped tokens to control exactly who can publish and who can only subscribe (watch).

MoQ is a publish/subscribe protocol for media delivery that's currently being standardized at the IETF. Last year, Cloudflare turned every server across its 330-plus-city network into a MoQ relay, offering free, open access so people could try out the protocol.

The story so far

That open relay from last year didn't have any authentication or access control built in. It was great for testing and experimenting with the protocol, but not something you'd want to rely on for a production application — anyone could publish, and anyone could watch.

What changes

The new provisioning API introduces two core resources:

  • Relays: isolated scopes that keep one application's streams separate from everyone else's
  • Tokens: credentials that grant specific operations — publish, subscribe, or both — to individual clients

That means you can now set up a streaming environment dedicated to your own application, fully separated from others. Tokens also support expiration and revocation, so you can issue separate credentials for publishers and viewers and cut off access to just the ones you no longer need.

Dive Deep

The interesting part is how the isolation actually works. Instead of spinning up dedicated servers or containers, Cloudflare creates isolated scopes across its existing global network. The blog compares it to adding a virtual host rather than starting a new web server. That's why creating a relay doesn't require picking a Region or thinking about load balancing — it's globally available immediately.

Creating things through the API is simple too. Here's how you create a relay:

curl -X POST "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/moq/relays" \
  -H "Authorization: Bearer $API_TOKEN" \
  -d '{"name": "Production Relay"}'

And here's how you issue an additional token for a relay:

curl -X POST https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/moq/relays/$RELAY_ID/tokens \
  -H "Authorization: Bearer $API_TOKEN" \
  -d '{"operations": ["subscribe"], "expires_at": "2027-01-01T00:00:00Z"}'

Each new relay comes with a default publish-and-subscribe token plus a subscribe-only token. In practice, that looks like piping video through ffmpeg into moq-pub with your publish token, while viewers connect through moq-sub using a subscribe-only token. You can also create a relay from the dashboard, under Media > Realtime > MoQ Relay, just by naming it.

The API supports both draft-14 and draft-16 of the MoQ Transport protocol, and draft-16 brings two new capabilities:

  • PUBLISH operation: lets publishers start sending tracks before a viewer even requests them, removing the delay from waiting on the subscription chain
  • SUBSCRIBE_NAMESPACE: lets subscribers request every track within a namespace at once, including tracks added later during a live stream

Right now, permissions are scoped at the relay level — separating publishers from subscribers — and Cloudflare says it's working with the IETF and the wider MoQ community on a richer permission model. The whole approach is documented in the MoQ CDN Provisioning Internet-Draft, aiming for a shared provisioning model across CDNs rather than a Cloudflare-only approach.

On pricing: the API is free to use at any scale during this MoQ beta period, though Cloudflare notes the API itself will keep evolving, so it's worth checking the docs for updates.

Wrap-up

  • Cloudflare launched a new provisioning API for MoQ, letting you create your own isolated relay
  • Relays separate streams per application; tokens control publish/subscribe permissions and expiration individually
  • Isolation happens across Cloudflare's existing global network, so there's no Region picking or load balancing to think about
  • draft-16 support adds the PUBLISH operation and SUBSCRIBE_NAMESPACE
  • Free during the beta period, built on an IETF Internet-Draft aimed at cross-CDN standardization

Whether you've already been testing Cloudflare's open MoQ relay or you're building production live-streaming infrastructure, this update is worth a look!

Related posts