An API for MoQ: Self-Service Isolated Relay Provisioning

Cloudflare has unveiled a provisioning API that lets you create application-specific isolated MoQ relays and issue separate credentials to publishers and subscribers. The created relays can be used across Cloudflare's global network within seconds, without deploying separate servers, adjusting capacity, or load balancing.

MoQ (Media over QUIC) is a public standard under development by the IETF—a publish/subscribe protocol in which publishers publish named data streams and subscribers request them. Relays don't interpret the content; they replicate and deliver it to multiple subscribers, and because they're built on QUIC, they support low latency and large-scale scaling.

Cloudflare's existing public MoQ relay could be used by anyone without authentication, making it suitable for protocol testing and client development, but it didn't provide the confidentiality, access control, and role separation needed in production environments. The new relay offers the following features:

• Per-application isolation of namespaces, tracks, and objects
• Separation of entry permissions and operation permissions for publishers and subscribers
• Global connectivity and routing via Anycast endpoints
• Relay provisioning without separate virtual machines, containers, or dedicated processes

Cloudflare provides MoQ Transport draft-14 and draft-16 with authentication support, and relays can be created via the API and the Cloudflare dashboard. It's available for free during the beta period.