Cloudflare Launches API for Isolated Media over QUIC Relays
Cloudflare introduces a new API for Media over QUIC (MoQ), enabling developers to provision isolated, authenticated relays across its global network without managing infrastructure.
Cloudflare has announced a significant advancement in its Media over QUIC (MoQ) offering with the release of a new provisioning API. This API empowers developers to create isolated relays for their applications, complete with granular access controls and authentication mechanisms for publishers and subscribers. By leveraging Cloudflare's extensive global network, users can now deploy these relays within seconds, bypassing the complexities of managing their own server infrastructure, including deployment, scaling, and load balancing.
The new feature supports draft-14 and draft-16 versions of the MoQ Transport protocol, incorporating essential authentication capabilities. Both the API and the Cloudflare dashboard can be used to provision these relays, which are currently available free of charge during their beta phase. This move addresses the limitations of Cloudflare's previous open MoQ network, which, while providing a global endpoint, lacked the necessary isolation and access controls for production environments.
MoQ, an open protocol under development at the IETF, operates as a publish-subscribe system. Publishers send data streams identified by names, and subscribers request these streams. Relays, essentially CDN servers, facilitate this by copying streams to all interested parties without inspecting the data content. This architecture allows for efficient fan-out from a single publisher to a large audience, and its foundation on QUIC ensures low latency, making it suitable for a variety of real-time applications.
Previously, Cloudflare offered a global MoQ relay network accessible to anyone for testing. However, the absence of authentication made it unsuitable for production use cases requiring confidentiality, access control, or distinct publisher/subscriber roles. Scenarios like live auctions, where precise timing and differentiated permissions are critical, were hindered by this limitation.
The newly provisioned relays function differently from traditional dedicated servers. Instead of spinning up virtual machines or containers, provisioning creates an isolated scope within Cloudflare's existing global network. This scope segregates namespaces, tracks, and objects, while also defining access permissions for publishers and subscribers. Clients connect to an Anycast endpoint, and Cloudflare manages the network routing, abstracting away infrastructure concerns.
The MoQ provisioning API acts as a control plane, managing relays and their associated tokens without handling the media traffic itself. Two primary resources are involved: the relay, which defines the isolated scope, and tokens, which serve as credentials granting specific operations (publish, subscribe, or both) on a relay. This token-based system allows for fine-grained access control, enabling administrators to issue tokens with expiration dates and revoke them individually without impacting other users.
Developers can provision relays and manage tokens via the HTTP API or the Cloudflare dashboard. The API allows for quick relay creation with a simple name, returning a relay ID and default tokens. Additional tokens can be created to grant narrower access, such as subscribe-only tokens with expiration dates. The dashboard offers a user-friendly interface for the same provisioning and token management tasks.
This release marks a significant step towards making MoQ a viable, scalable, and secure protocol for real-time communication applications. By abstracting away infrastructure management and providing robust access controls, Cloudflare aims to lower the barrier to entry for developers building latency-sensitive applications.