OAuth apps on Cloudflare hit 1,000 mark since June with over 1 million user consents

KUALA LUMPUR, 21 AUGUST 2026 —

Cloudflare Inc said it now hosts more than 1,000 third-party OAuth applications on its platform, with over 1 million user authorisations since June.

Client owners can mark specific scopes as optional when configuring an OAuth client. The updated consent screen then lets users deselect those scopes. Developers must check the granted scopes after exchanging the authorisation code, rather than assuming the entire requested set was approved.

For example, a client configured with user-details.read, workers-scripts.write, workers-kv-storage.write and zone.read can mark the last two as optional. If the app later requests only workers-scripts.write and zone.read, the consent screen shows only those two scopes. Required scopes remain mandatory if included in the request.

The change keeps the consent screen focused on the task at hand instead of exposing every capability the application could ever request. Developers who opt into the feature retain existing behaviour if they do not designate any scopes as optional.

Cloudflare said it is also expanding account and zone-level role controls across nearly every product. Over the coming weeks, the company will add more API token roles, account membership options and OAuth scopes to give customers finer-grained access controls.

The update follows a trend in the developer ecosystem toward more granular security models. According to Cloudflare, the move aligns with increasing demand from security-conscious users for better control over third-party access.