# Cloudflare's Self-Managed OAuth Opens Up to Every Developer!

Hi everyone, it's Shiichan! Today's story clears up something that always felt a little awkward when you build integration apps. Cloudflare has opened up Self-Managed OAuth to all developers!

## What was announced?

This one comes from the Cloudflare Blog. It's an announcement-plus-deep-dive post: the general availability (GA) of a new feature bundled with the engineering story of the big migration behind it.

In one line, here's the news:

> Self-Managed OAuth is now available to all developers on Cloudflare.

That means developers can create their own OAuth clients and offer Cloudflare users a standard flow where they grant scoped, delegated access. It's really handy when you build SaaS integrations, internal developer platforms, and the agentic tools that are becoming more common.

## The story so far

Until now, third-party OAuth on Cloudflare was only available through a small number of manually onboarded integrations. It worked through Wrangler and select integrations like PlanetScale, but it wasn't something everyone could just pick up and use.

So what did regular developers do? They had to rely on API tokens. But API tokens are harder to manage, and they're a poor fit for many delegated application flows where an app acts on a user's behalf. Everyone was making it work, but it was a bit of a stretch.

## What changes

From now on, anyone can create their own OAuth client and handle delegated access. And because it's a standard OAuth flow, there's a lot to like on the user's side too.

- Clearer consent screens that show exactly what an app can do
- Easy revocation from the dashboard anytime
- More visibility into what you've granted, which helps prevent phishing

Both the builders and the users get a setup they can trust.

## Dive Deep

Here's where the engineering story really kicks in! To make this rollout possible, Cloudflare had to upgrade the core OAuth engine running under the hood.

Cloudflare OAuth is powered by Hydra, an open-source OAuth engine, and the surgery was moving it to newer versions without any downtime. To pull that off, the team packed in several clever tricks.

For the Hydra 1.X upgrade, they rewrote the SQL migrations using `CREATE INDEX CONCURRENTLY` so tables wouldn't take exclusive locks. They also built a custom version that selects explicit columns instead of `SELECT *` to avoid deserialization issues. The result: no user impact.

The next upgrade to Hydra 2.X was the big one, with database migrations that take multiple hours. So they used a blue-green deployment with these safeguards:

- Extended token expiry to several hours, so apps could keep working during the migration window without needing to refresh right away
- A revocation queue built with Cloudflare Queues: during the migration, each revocation event was written to the queue and replayed after the upgrade, so access a user had revoked wouldn't accidentally come back to life
- Refresh token coalescing: caching logic to fix retry scenarios that would invalidate an entire token chain, which matters a lot for high-volume clients like Wrangler and MCP

The scale of the production migration was wild too. 132.5M rows updated, 114.7M rows inserted, 136.97 GB of temporary storage, and 22.2k transaction commits, all in about three hours of net production runtime.

And performance improved nicely after the migration.

| Metric | Improvement |
| --- | --- |
| API P95 latency | -45% (185 ms to 101 ms) |
| Memory usage | RSS -14% / heap allocation -40% |
| CPU usage | -37% |
| Goroutines | -23% |

Migrating without downtime, and coming out faster and lighter? That's two wins in one!

Getting started is simple. Head to the OAuth apps page in the Cloudflare dashboard, create a client, and set scoped permissions. The full steps are documented in Cloudflare's Fundamentals docs.

## Wrap-up

- Self-Managed OAuth is now open to all Cloudflare developers (it used to be limited to a few manually onboarded integrations)
- Delegated access that relied on API tokens can now use a standard OAuth flow
- Users get clearer consent, dashboard revocation, and better visibility
- Behind the scenes, Hydra was migrated with zero downtime using blue-green deployment, with a Cloudflare Queues revocation queue and token coalescing as key moves
- After the migration, performance improved too: P95 latency -45%, CPU -37%, and more

This is a perfect fit for developers who want to build SaaS integrations, internal tools, or agentic apps on Cloudflare!