Notifications
Clear all
Topic starter
18/08/2026 2:53 pm
TL;DR: Cloudflare’s move to extend OAuth to all users with Ory Hydra processed 132.5 million row updates, 114.7 million inserts, 22,200 commits, and no session breaks while cutting P95 API latency 45%, according to Ory. The lesson is that identity infrastructure for machine and human access now has to behave like core platform plumbing, not a side service.
NHIMG editorial — based on content published by Ory: Ory Hydra Powers OAuth at Cloudflare Scale; and It's Just Getting Started
By the numbers:
- Cloudflare’s migration processed 132.5 million rows updated during the OAuth rollout.
- 114.7 million rows while keeping user sessions intact., user sessions intact.
- After upgrading to Ory Hydra 2.X, Cloudflare cut P95 API response times by 45%, from 185ms to 101ms.
Questions worth separating out
Q: How should IAM teams migrate OAuth systems without breaking active sessions?
A: Use a staged cutover with blue-green deployment, replayable queues, and extended token expiry windows so live sessions survive the transition.
Q: Why do large OAuth platforms need different governance than smaller IAM systems?
A: Because scale turns identity into critical infrastructure.
Q: What breaks when token expiry windows are too rigid during migration?
A: Rigid expiry windows can invalidate active sessions before the new environment is fully stable, which creates user disruption and can also produce inconsistent authorization state.
Practitioner guidance
- Test identity cutovers with production-like replay loads Run migration drills that include token expiry changes, queued event replay, revocation reconciliation, and rollback validation at real transaction volumes.
- Verify revocation continuity across blue-green deployments Map how revocations, session state, and refresh tokens behave when records are moved between environments so active access does not outlive the intended policy state.
- Measure identity platform headroom before expanding scope Benchmark P95 latency, heap allocation, CPU use, and database churn under peak authentication and authorization workloads before you extend OAuth to more users or systems.
What's in the full article
Ory's full blog post covers the operational detail this post intentionally leaves for the source:
- Cloudflare's migration sequencing and blue-green deployment mechanics for OAuth state changes
- Detailed breakdown of how Queue-backed replay preserved revocations and session continuity
- The full before-and-after performance numbers for API latency, memory use, and CPU consumption
- Implementation context for teams considering large-scale OAuth expansion across user populations
👉 Read Ory's Cloudflare OAuth scale case study and migration details →
OAuth at Cloudflare scale: what it means for IAM teams?
Explore further
18/08/2026 3:37 pm
Identity infrastructure has become core platform infrastructure, not a peripheral IAM layer. Cloudflare’s migration shows that when OAuth is extended across an entire user base, the identity service becomes part of the product’s operational backbone. That changes how teams should evaluate resilience, change management, and failover for authorization systems. The practitioner conclusion is straightforward: identity engineering and platform engineering now share the same blast radius.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, which reinforces how fragile identity operations still are under scale.
A question worth separating out:
Q: Who should own identity resilience in a platform migration?
A: IAM, security architecture, and platform engineering should share ownership. Identity resilience is not only about policy design or only about infrastructure uptime. It depends on how token state, revocation records, replay systems, and database changes are coordinated across the migration lifecycle.
👉 Read our full editorial: Cloudflare’s Ory Hydra migration shows the cost of OAuth scale
