techlist.io
KREN
cloudflare

An API for MoQ: provision your own isolated relays (opens in new tab)

cloudflarejwtcdnwebrtcquichttp-3media-over-quic

Cloudflare has moved MoQ from an open testing network toward production use by adding isolated relays and authentication. Its provisioning API and dashboard let applications create globally available relay scopes and issue separate publisher and subscriber credentials, without deploying infrastructure. The beta supports MoQ Transport drafts 14 and 16 and is currently free.

MoQ and Its Architecture

  • MoQ is an open IETF publish/subscribe protocol built on QUIC, the transport used by HTTP/3.
  • Publishers send named data streams, while subscribers request those streams through relays.
  • Relays copy data to subscribers without inspecting its contents, enabling efficient fan-out.
  • The same system can support live video, video calls, low-latency messaging, and other real-time workloads.
  • Using CDN-based relays avoids the cost and complexity of operating specialized media servers.

From Open Preview to Production

  • Cloudflare’s initial MoQ preview exposed an unauthenticated relay on servers in more than 330 cities.
  • Over 1,000 clients continue to use the open endpoints daily for testing and development.
  • The lack of authentication made the preview unsuitable for applications requiring confidentiality or role-based permissions.
  • For example, live auction applications need broadcasters to publish while viewers can only subscribe.

Isolated Cloudflare Relays

  • Provisioning a relay creates an isolated scope across Cloudflare’s existing global network rather than starting a VM, container, or dedicated process.
  • Each scope separates an application’s namespaces, tracks, and objects from those of other applications.
  • Clients connect through an Anycast endpoint, with Cloudflare handling global routing.
  • Relays become available within seconds, without regional capacity planning, load balancers, or server management.
  • Cloudflare compares the model to creating a virtual host rather than deploying a new web server.

Provisioning API and Access Tokens

  • The control-plane API manages relay configuration and credentials but does not handle the media flowing through relays.
  • A relay defines the isolated application scope.
  • Tokens grant publish, subscribe, or both operations for a specific relay.
  • Tokens can have expiration times and can be revoked independently.
  • Creating a relay automatically returns:
    • A token capable of publishing and subscribing.
    • A subscribe-only token intended for viewers.
  • Additional narrowly scoped tokens can be created through the API or dashboard.
  • Current tokens apply to an entire relay; Cloudflare is working with the MoQ community on more granular authorization.

Using the API and Dashboard

  • A relay can be created with one authenticated API request containing its name.
  • Tokens can be added through an endpoint such as /moq/relays/$RELAY_ID/tokens.
  • The dashboard workflow is available under Media > Realtime > MoQ Relay.
  • Applications should provide broadcasters with publish-capable credentials and viewers with subscribe-only credentials.

Connecting Clients

  • Clients send their token when opening a MoQ session.
  • The relay enforces the token’s permitted operations.
  • Cloudflare’s open-source moq-rs tools can be used with media generated by tools such as ffmpeg.

Cloudflare’s authenticated, isolated MoQ relays make the protocol more practical for production real-time applications. Developers can use the API or dashboard to provision a globally distributed relay and manage separate, expiring credentials without operating their own media infrastructure.