Cloudflare Announces API for Provisioning Isolated MoQ Relays
The new MoQ provisioning API allows you to create isolated relays for your applications.
1What is MoQ?
MoQ (Media over QUIC) is a new open protocol being developed by the Internet Engineering Task Force (IETF). The IETF, which also standardized HTTP, TLS, and QUIC, is making MoQ a free public standard (RFC) that anyone can implement. MoQ is a publish/subscribe system where publishers send out named data streams, and subscribers request these streams by name. Relays act as CDN servers that copy each stream to all interested parties.
2Cloudflare's Role
Last year, Cloudflare enabled MoQ on every server, offering a global MoQ endpoint. However, these endpoints lacked the isolation and access controls needed for running applications. The new MoQ provisioning API lets you create isolated relays for your apps and issue separate credentials for publishers and subscribers. Relays you create become available across Cloudflare's network within seconds, with no need to deploy or manage servers.
3Technical Advantages
MoQ runs on QUIC, the transport layer beneath HTTP/3, ensuring low latency. Since relays don't inspect data content, the same protocol can carry diverse systems like live video, video calls, and low-latency messaging. Users can publish to a CDN via a simple API, achieving both large scale and low latency without the cost of maintaining specialized server fleets.
4Production Use
Last year's open preview required no authentication, making it ideal for protocol testing and client development but unsuitable for production. The new API removes these limitations, enabling applications requiring confidentiality, access control, or clear publisher/subscriber roles. For instance, live auction sites need bids to reach bidders in milliseconds, which MoQ now supports securely.
5Relay Structure
On Cloudflare, provisioning a relay doesn't start a VM or container but creates an isolated scope across the existing global network. This scope separates your namespaces, tracks, and objects from others'. It also defines who can enter the scope and their permissions. Clients connect to the Anycast endpoint, and Cloudflare handles routing across the network.
6Provisioning via API
The provisioning API is a control plane that manages relays and access tokens without handling media. There are two resource types: relays (isolated scopes) and tokens (credentials authorizing operations on a relay). Different tokens for publishers and subscribers prevent viewers from hijacking broadcasters' tracks. Tokens can be scoped, time-limited, or revoked individually.
7Usage Scenarios
Relays can be created via API or the Cloudflare dashboard. Broadcasters get publish/subscribe tokens, while viewers receive subscribe-only tokens. Each client sends its token when connecting. Tokens can expire or be revoked, granting precise access control. This ensures clients get only the access they need, which can be revoked later without affecting others.
8Future Contributions
Currently, each token applies to an entire relay, permitting publishing, subscribing, or both. Cloudflare is collaborating with the IETF and MoQ community on a richer authorization scheme. User feedback is encouraged at [email protected]. During beta, relays are free to use.