Cloudflare MoQ Provisioning API: Provisioning Isolated Relays for Low-Latency Media

Beyond Unauthenticated Testing: The Need for Isolated MoQ Relays

When Media over QUIC (MoQ) was initially launched across Cloudflare’s global network, every server in over 330 cities functioned as an open, unauthenticated MoQ relay. While this setup attracted over 1,000 unique daily test clients, open relays present structural risks for production applications. Without identity verification or stream isolation, any connected client can publish to any namespace or subscribe to arbitrary streams.

Production use cases—such as real-time interactive auctions, live sports broadcasts, or low-latency communications—require strict access boundaries. A viewer watching an auction bid stream must not possess credentials that allow them to hijack the publisher’s track or inject unauthorized data. To address this, Cloudflare released a control plane provisioning API that brings tenant isolation, token-based authentication, and dynamic credential revocation to global MoQ relays.

Architecture: Virtual Scopes vs. Dedicated Infrastructure

In traditional architecture models, deploying a media relay requires running dedicated processes, managing virtual machines, or spinning up specialized containers, followed by routing ingress traffic through external load balancers. Scaling out involves manually forecasting geographic capacity and instantiating additional compute resources.

Cloudflare’s MoQ relay implementation takes a serverless approach similar to web virtual hosting (vhosts). Provisioning a relay does not start isolated hardware or software containers. Instead, the provisioning API establishes an isolated scope—a logical security and routing boundary—across Cloudflare’s existing Anycast network. This scope isolates namespaces, tracks, and objects, keeping streams from different applications completely separate while utilizing shared edge infrastructure.

The Control Plane: Relays, Tokens, and Access Control

The MoQ provisioning architecture separates the control plane (management operations) from the data plane (media streaming). The control plane manages logical scopes and access tokens without intercepting or processing the actual media packets flowing through the relay.

Two primary resources define this control plane model:

• Relay: The top-level isolated logical scope that defines an application’s execution environment. Namespaces created within one relay scope remain completely invisible to other relays.
• Token: A scoped credential that defines allowed operations for a client inside a specific relay scope. Operations are explicitly categorized into publish, subscribe, or both.

Tokens can be created with explicit expiration timestamps and revoked independently without interrupting active sessions associated with other credentials. Currently implemented as Cloudflare JWTs, these tokens travel directly in the URL path when a client initiates a session over the Anycast endpoint.

Step-by-Step: Provisioning Isolated Relays via REST API

Creating an isolated relay requires a single HTTP POST request to Cloudflare’s control plane API, passing the account identifier and a user-defined relay name.

curl -X POST 
  "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/moq/relays" 
  -H "Authorization: Bearer $API_TOKEN" 
  -H "Content-Type: application/json" 
  -d '{"name": "Production Relay"}'

Upon creation, the API returns a response containing a unique relay identifier (uid) alongside two default tokens: one granting dual publish and subscribe rights, and one restricted strictly to subscribe operations.

{
  "result": {
    "uid": "a1b2c3d4e5f67890a1b2c3d4e5f67890",
    "name": "Production Relay",
    "issuers": [
      {
        "type": "cloudflare_jwt",
        "issuer": "cloudflare",
        "cloudflare_tokens": [
          {
            "operations": ["publish", "subscribe"],
            "expires": "2027-03-27T15:00:00Z",
            "secret": "eyJ..."
          },
          {
            "operations": ["subscribe"],
            "expires": "2027-03-27T15:00:00Z",
            "secret": "eyJ..."
          }
        ]
      }
    ]
  }
}

To issue tailored, viewer-specific credentials with limited lifetimes, developers can invoke the relay’s token endpoint directly:

curl -X POST 
  "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/moq/relays/$RELAY_ID/tokens" 
  -H "Authorization: Bearer $API_TOKEN" 
  -d '{"operations": ["subscribe"], "label": "viewers", "expires_at": "2027-01-01T00:00:00Z"}'

Connecting Clients: Practical Workflow with ffmpeg and moq-rs

Once credentials are generated, publishers and subscribers connect to Cloudflare’s draft endpoints by including the operational token in the connection URL. When a session opens, the edge relay evaluates the token capabilities before granting publishing or subscription streams.

Using open-source tools such as moq-rs alongside ffmpeg, a broadcaster can pipeline fragmented MP4 video to a publisher client using a token with publish access:

ffmpeg -stream_loop -1 -re -i input.mp4 -f mp4 
  -movflags empty_moov+frag_every_frame+separate_moof+omit_tfhd_offset - 
  | moq-pub -- --name my-namespace "https://draft-16.cloudflare.mediaoverquic.com/<publish_subscribe_token>"

On the receiving end, end-user clients establish a connection using a subscribe-only token, piping the standard output directly into a local player like ffplay:

moq-sub --name my-namespace "https://draft-16.cloudflare.mediaoverquic.com/<subscribe_token>" 
  | ffplay -hide_banner -an -

MoQ Transport Draft-16 Enhancements: PUBLISH and SUBSCRIBE_NAMESPACE

In addition to control plane isolation, support has been updated for draft-14 and draft-16 of the IETF MoQ Transport protocol specification. Draft-16 introduces two major protocol features that significantly improve stream establishment and dynamic tracking:

• PUBLISH Command: Allows a broadcaster to proactively push media tracks to the edge relay before any viewer requests them. In previous drafts, the initial stream delivery was blocked until a subscriber’s request traversed the network back to the origin publisher. With PUBLISH, edge relays buffer media immediately, reducing time-to-first-frame for initial viewers.
• SUBSCRIBE_NAMESPACE Command: Enables subscribers to request all current and future tracks within an entire namespace under a single subscription session. Rather than manually issuing individual track subscriptions, a client automatically receives dynamically added renditions, such as supplementary multi-language audio channels or adaptive bitrate video switches introduced mid-stream.

Industry Standardization: The MoQ CDN Provisioning Draft

To avoid vendor lock-in across real-time streaming architectures, Cloudflare is standardizing its control plane design through an official IETF Internet-Draft titled MoQ CDN Provisioning.

This draft introduces the term scope to describe a standardized boundary for multi-tenant delivery. By establishing open specifications for scope management and credential assignment, the goal is to enable developers to deploy client applications and switch or combine CDN relay providers without rewriting control plane logic or token exchange mechanics.

Beta Limitations and Future Roadmaps

While the MoQ provisioning API and edge infrastructure are available for use at any scale during the beta preview, developers should account for current operational parameters:

• Token Scope Granularity: Tokens currently grant capabilities (publish/subscribe) across an entire relay scope. Finer-grained permissions—such as restricting tokens to specific sub-namespaces or track names—are under active development within the IETF working group.
• Specification Evolution: Because MoQ Transport and MoQ CDN Provisioning remain active IETF Internet-Drafts, wire formats and API schema definitions are subject to breaking updates in future protocol revisions.
• Beta Pricing: Provisioning relays and streaming media through Cloudflare’s MoQ edge network remains completely free of charge throughout the public beta phase.

Primary reference: Review the original announcement for exact release details. This article is an independent explanation and does not reproduce the source text.