Securing non-human identities: automated revocation, OAuth, and scoped permissions
2026-04-22T19:24:07Z•b303c19718c918ae502591c28156f5de16bbd8a0546864c0a02eafdf99573f28
account-abuseacmeai-securityapi-tokenscertificate-validationclient-side-securitycloudflareddosleast-privilegelog-explorermanaged-oauthmcpoauthpingorapost-quantumpq-cryptorequest-smugglingresource-scoped-permissionsvulnerability-scannerworkers-vpc
What happened
A collection of Cloudflare blog posts (Mar–Apr 2026) announcing developer- and platform-security improvements, new products, and vulnerability disclosures/fixes. Key items: scannable API tokens, enhanced OAuth visibility and Managed OAuth for agent authentication (RFC 9728), GA of resource-scoped permissions to enforce least-privilege, and a reference architecture for safer MCP adoption (including token-cost reductions). Cloudflare moved its target for full post-quantum protection to 2029 and published additional PQ transparency tooling in Radar. Security product updates include Client-Side S
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cloudflare_security_blog
- Record identifier
- b303c19718c918ae502591c28156f5de16bbd8a0546864c0a02eafdf99573f28
- Enrichment time
- 2026-04-22T19:24:07Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.