Securing non-human identities: automated revocation, OAuth, and scoped permissions

2026-04-24T07:24:10Z3a1f2d78331572f7142b6cbe6f02f8a0a39f0fd070309e7ad9972c397d7a1b9b
LLMRFC 9728account abuseacmeai securityapi tokenscertificate validationcgnatclient-side securitycloudflareddosfraud preventionlog explorermanaged oauthmcpnon-human identitiesoauthpingorapost-quantumpqrequest smugglingresource-scoped permissionsscannable tokensvulnerability scannerworkers vpc

What happened

Cloudflare published a broad set of security and product updates (Apr 2026) including new developer security controls (scannable API tokens, resource-scoped permissions GA, enhanced OAuth visibility) and Managed OAuth for Access (RFC 9728) to better support non-human identities and agent workflows. They accelerated a post-quantum roadmap (targeting full post-quantum security by 2029), opened advanced client-side security and AI security offerings to more customers, released an API/Web vulnerability scanner and expanded Log Explorer datasets, and announced account-abuse/fraud prevention tooling

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
cloudflare_security_blog
Record identifier
3a1f2d78331572f7142b6cbe6f02f8a0a39f0fd070309e7ad9972c397d7a1b9b
Enrichment time
2026-04-24T07:24:10Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.

Record · Securing non-human identities: automated revocation, OAuth, and scoped permissions · Baitaphish