## Article: MoQ Relay Provisioning on Cloudflare — Isolation, Control, and Live Delivery
Cloudflare has launched a new API and dashboard capabilities for provisioning isolated Media over QUIC (MoQ) relays. This builds on last year’s global MoQ relay preview—where every Cloudflare server acted as an open MoQ relay—by adding the isolation and access controls needed for production workloads. The new MoQ provisioning API lets you create an isolated relay for your application and issue separate credentials for publishers and subscribers. Relays are available across Cloudflare’s network within seconds, with no servers to deploy, size, or load balance.
### What is MoQ?
MoQ (Media over QUIC) is an open IETF draft protocol designed for publish/subscribe workloads. It treats relays as simple forwarding intermediaries that don’t inspect the payload, enabling a single publisher to reach many subscribers without handling fan-out itself. MoQ runs on QUIC (the transport behind HTTP/3), keeping latency low and enabling use cases such as live video, video calls, and low-latency messaging over a single protocol.
Because relays don’t care what’s inside the data, MoQ can consolidate multiple specialized systems into one. You publish to a CDN via a simple API and get both low latency and large scale for less cost, without managing fleets of specialized servers.
### Why a Relay Provisioning API?
During last year’s open preview, Cloudflare ran MoQ endpoints that required no authentication—ideal for testing and development, but unsuitable for production. Production applications need confidentiality, access control, and a clear separation between publisher and subscriber roles. A live auction, for example, must ensure that a viewer’s credentials cannot be used to hijack a publisher’s tracks, and that bids reach bidders in milliseconds.
The provisioning API solves this by creating isolated “scopes” (logical delivery contexts) on Cloudflare’s existing global network. Each scope separates namespaces, tracks, and objects from others, and defines who can enter and whether they can publish, subscribe, or both. Provisioning does not start a VM or container—it adds an isolated configuration and set of credentials to the existing network, making a relay available immediately without choosing regions, estimating capacity, or setting up load balancers.
### Using the MoQ Provisioning API
You can provision relays via the HTTP API or the Cloudflare dashboard. Each relay comes with at least two tokens:
– A publish-and-subscribe token for publishers.
– A subscribe-only token for viewers.
Tokens are scoped to specific operations, can be given an expiration, and can be revoked independently without disrupting other clients. This lets you grant exactly the access a client needs and take it back later.
#### With the API
Creating a relay is a single API call:
“`bash
curl -X POST “https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/moq/relays”
-H “Authorization: Bearer $API_TOKEN”
-H “Content-Type: application/json”
-d ‘{“name”: “Production Relay”}’
“`
The response includes a relay ID and two default tokens. To give a client narrower access, you can add more tokens (e.g., subscribe-only tokens that expire at the start of 2027).
#### In the Dashboard
Navigate to **Media > Realtime > MoQ Relay**, select **Create relay**, give it a name, and confirm. You can also create and manage tokens for publishers and viewers under the same UI.
### Connecting a Publisher and a Subscriber
Once you have a relay and tokens, provide the appropriate token to each client. The token travels in the URL path, and the relay enforces allowed operations when a session opens.
Example with moq-rs publisher:
“`bash
ffmpeg -stream_loop -1 -i input.mp4 -f mp4 -movflags empty_moov+frag_every_frame+separate_moof+omit_tfhd_offset
| moq-pub –name my-namespace “https://draft-16.cloudflare.mediaoverquic.com/
“`
Example subscriber:
“`bash
moq-sub –name my-namespace “https://draft-16.cloudflare.mediaoverquic.com/
“`
The relay reads the token and checks whether the requested operation is permitted.
### Draft-16 Support and New Features
Cloudflare now supports draft-16 of the MoQ Transport protocol. Key additions relevant to publishing and subscribing include:
– `PUBLISH`: Allows a publisher to send a track to a relay before any viewer subscribes. The relay can already receive the track, reducing latency for the first viewer.
– `SUBSCRIBE_NAMESPACE`: Lets a subscriber request every track announced under a namespace, including tracks added later during a live stream.
You can connect draft-16 clients to use both features today.
### Built in the Open
MoQ is an open standard developed at the IETF. To promote interoperability, Cloudflare is documenting the provisioning design in the MoQ CDN Provisioning Internet-Draft. While still an Internet-Draft (not yet an RFC), it establishes a common model for scopes and credentials. The goal is for multiple CDN and relay implementations to support a common provisioning model.
### Available Today, Free in Beta
The MoQ relay provisioning API is available now as part of the MoQ beta. It is free to use at any scale during this preview period. The API may change as we iterate, so check the developer docs for updates and breaking changes.
We welcome feedback on permissions, signing keys, and other features. Reach us at moq@cloudflare.com.
—
## FAQ
**Q: What is a MoQ relay provisioning API?**
A: It’s an API that lets you create isolated MoQ relays (logical delivery contexts) on Cloudflare’s global network and issue separate credentials for publishers and subscribers. You can provision relays via HTTP API or the Cloudflare dashboard, and they are available instantly without managing servers.
**Q: Are MoQ relays free?**
A: Yes. During the beta preview, MoQ relays are free to use at any scale.
**Q: How do I control who can publish or subscribe?**
A: You create tokens with specific operations (publish, subscribe, or both) and expiration. Hand publishers one token and viewers another; the relay enforces permissions when sessions open. Tokens can be revoked independently without affecting others.
**Q: What does “isolated relay” mean?**
A: An isolated relay is a logical scope that separates your namespaces, tracks, and objects from other relays. It uses Cloudflare’s existing Anycast network for routing; no VM, container, or load balancer is required.
**Q: Which MoQ draft versions does Cloudflare support?**
A: Cloudflare supports draft-14 and draft-16 of the MoQ Transport protocol with authentication.
**Q: Can I use the dashboard instead of the API?**
A: Yes. You can create relays and manage tokens entirely through the Cloudflare dashboard under Media > Realtime > MoQ Relay.
**Q: Do I need to install software to run a relay?**
A: No. Provisioning a relay adds configuration to Cloudflare’s existing infrastructure—no servers to deploy, size, or load balance.
—
## Conclusion
Cloudflare’s new MoQ relay provisioning API brings isolation and access control to a global Media over QUIC relay network, enabling production-ready publish/subscribe workloads without managing server fleets. With instant provisioning, fine-grained token permissions, and draft-16 support for `PUBLISH` and `SUBSCRIBE_NAMESPACE`, MoQ provides a flexible, low-latency foundation for live video, calls, and real-time messaging. The service is free during beta, making it an accessible option for developers building real-time media applications on the Cloudflare network. For updates and feedback, refer to the developer docs or reach out to moq@cloudflare.com.
