Managed OAuth for Access: make internal apps agent-ready in one click

Here's a 2-3 sentence summary of the blog post on securing non-human identities: To secure non-human identities, such as agents and scripts, Cloudflare has introduced updates to manage their entire lifecycle, including scannable tokens, OAuth visibility, and resource-scoped RBAC to fine-tune policies. The company's new token formats, with a scannable "cf" prefix and checksum, enable automated security tools to easily identify and revoke leaked API tokens, and its partnership with GitHub detects and revokes leaked tokens in public and private repositories. Cloudflare One customers also benefit from these features, as DLP profiles can detect and block credential leaks across network traffic, email, and SaaS applications, and the company's AI Gateway scans and blocks AI traffic in real-time.

Cloudflare developed a unified security architecture to govern AI usage with Model Context Protocol (MCP) across its enterprise, addressing security risks such as authorization sprawl and supply chain risks. To achieve this, they built a centralized team to manage MCP server deployment, using a shared MCP platform with governed infrastructure, CI/CD pipelines, secrets management, and audit logging. This centralized approach enabled rapid adoption and provided visibility into MCP server usage while maintaining control over software sources.