Cloudflare has introduced a provisioning API for Media over QUIC (MoQ), letting developers create isolated relays with distinct access controls for publishers and subscribers. The move builds on last year’s open preview, which turned every Cloudflare server in over 330 cities into a shared, unauthenticated MoQ relay for protocol testing.
MoQ is a publish/subscribe protocol under development at the IETF, the same standards body behind HTTP, TLS, and QUIC. Publishers send named streams of data, subscribers request those streams by name, and relays (essentially CDN servers) copy the data to everyone who wants it without needing to inspect its contents. Because relays are content agnostic, the same protocol can support live video, video calls, low latency messaging, and other real time use cases. It runs on QUIC, the transport underlying HTTP/3, which helps keep latency low.
Why isolation matters
The original open MoQ network was useful for testing (Cloudflare says more than 1,000 unique clients still connect daily), but it lacked the access controls needed for production applications. Without authentication, there was no way to separate publisher and subscriber roles or restrict who could send versus receive data. Cloudflare points to a live auction site as an example: bids need to reach bidders in milliseconds, but publisher and subscriber permissions must be kept separate so a viewer’s credentials can’t be used to hijack the publisher’s stream.
How the new relays work
Unlike typical MoQ deployments, where a relay is a dedicated server or process that must be scaled with more instances and load balancers, a Cloudflare relay is an isolated scope created across the existing global network. Provisioning one does not start a virtual machine or container. Instead, it separates an application’s namespaces, tracks, and objects from other relays and defines who can enter that scope. Cloudflare compares this to adding a virtual host rather than standing up a new web server, since the underlying infrastructure is already running.
The provisioning API is a control plane only. It manages relays and access tokens but never touches the media flowing through them. A relay is the isolated scope itself, while a token is a credential scoped to specific operations (publish, subscribe, or both) on a single relay. Tokens can be given expiration dates and revoked individually, allowing fine grained control over publisher and subscriber access without disrupting other clients.
Getting started
Relays can be created through the Cloudflare dashboard or via a single HTTP API call that requires only a name. Cloudflare returns a relay ID along with two default tokens, one allowing both publish and subscribe operations, and one restricted to subscribe only. The service supports the draft-14 and draft-16 versions of the MoQ Transport protocol with authentication, and Cloudflare says relays are free to use during the current beta period.