Goodbye API Tokens: Build Your Own Cloudflare OAuth Clients!

Hey there, it's me, Shiichan! Today I found a lovely update about connecting apps to Cloudflare, so let me share it with you.

Cloudflare Changelog developers.cloudflare.com

What was announced?

On the Cloudflare Changelog, they announced self-managed OAuth clients. Developers can now create and manage their own OAuth applications that integrate with Cloudflare.

OAuth lets a third-party application act on behalf of a user to access their Cloudflare account, once the user grants consent. The post gives a nice example: after a user approves, Wrangler can deploy Workers into that account.

The story so far

Until now, the usual way for an external app to call Cloudflare APIs was an API token. But tokens can be a bit awkward to copy around and manage, right?

This new OAuth flow is described as a "more secure, user-friendly, and manageable alternative to API tokens." Because the user themselves grants consent, the whole permissions picture gets much clearer.

What changes

Developers can now build and manage their apps from Manage account > OAuth clients in the Cloudflare dashboard.

And users can review exactly which scopes an app is requesting before they consent. So you're much less likely to accidentally hand over more access than you meant to.

Dive Deep

Let me look a little closer.

• Only the scopes you need: if you've used an API token before, the scopes will feel familiar. You pick only the scopes your app needs at creation time, and include that scope list when you send users to Cloudflare for consent.
• Private and public apps: applications start with private visibility. A private app can only be used by members of the account where it was created. To make it available to any Cloudflare user, you complete the prerequisites for public visibility.
• Domain verification before going public: before an app can be public, you must complete client domain verification. This helps users confirm the app owner controls the domain shown on the consent page. After verification, users see a verified badge on the consent page.

Wrap-up

• Cloudflare launched self-managed OAuth clients, so developers can build their own OAuth apps
• It's positioned as a safer, friendlier alternative to API tokens, and users can review scopes before consenting
• Apps start private; making them public requires domain verification, which earns a verified badge

This one is especially handy for developers building tools and services that integrate with Cloudflare!