2026-06-27 · cloudflare
Cloudflare announced on June 24, 2026 that self-managed OAuth is now available to all customers, allowing developers to build delegated integrations without relying on broad API tokens. The security-relevant part is the migration story: Cloudflare upgraded its OAuth engine while preserving revocations, replaying queued changes, and restoring data when migration behavior corrupted valid session state. That is a concrete reminder that identity data and access-control records need resilient recovery paths.
Cloudflare expanded OAuth app creation to all customers and described upgrades to consent, revocation, abuse prevention, and its underlying Hydra OAuth engine. During the migration, Cloudflare used queues to preserve revocation events and data restoration to recover from authorization-state corruption.
Identity and authorization data is not ordinary application metadata; corrupted or missing revocation records can restore access that users deliberately removed. If attackers or migration failures damage access-control state, organizations can lose both security visibility and the ability to prove who had permission at a given time.
Cold storage protects historical identity exports, configuration snapshots, and recovery evidence from being rewritten during a live incident or failed migration. Keeping offline copies of access policies, token inventories, audit logs, and revocation records gives teams a trusted baseline for rollback, investigation, and legal defensibility.
Read Original Post →