Media Updates & Release Notes

You can now view account-level analytics for your Images transformation usage.

Go to Images & Stream > Transformations > Analytics to view sampled estimates of image transformation request traffic, including:

• Requests by source, split between URL-based transformations and Images binding transformations
• Top zones, transformation configurations, and origin hosts for URL-based requests
• Top Worker scripts for Images binding requests

Use these analytics to identify the zones, configurations, origins, and Workers generating the most image transformation requests.

We've added more ways to manage and manipulate images with the Images binding. Here's what's new:

Render text into an image

Output a string of text into its own image or draw it over another image.

• Use the .text() method to rasterize text with the Images binding.
• Style content using the font, size, and color options.
• The draw array in cf.image now accepts a text key.

Manage hosted images without an API token

• Metadata filtering: Pass filter.metadata to .list() to return images by custom metadata. Match a bounded range by setting two operators in one condition, for example, priority: { gte: 2, lte: 5 }.
• Server-side signing: Get a signed URL for a private image with .signedUrl().
• User uploads: Create a Direct Creator Upload link with .createDirectUpload() so that a client can upload an image to your storage.

Set headers in a single call

• Pass a headers option to .response() to set headers without rebuilding the Response.
• Content-Type is always taken from the optimized image and can't be overridden by a specified header.
• Set Cache-Control with Workers Cache to cache your optimized image at the edge.

For more information, refer to Optimize with Workers, Draw overlays and watermarks, and Manage hosted images with Workers.

What changed

Realtime SFU DataChannels now support unordered and partially reliable delivery. DataChannels remain reliable and ordered by default, so existing channels keep their current behavior.

With ordered delivery, a delayed message can block later messages. For game state or sensor updates, recent data may be more useful than recovering an older message. Unordered delivery lets later messages proceed, while partial reliability limits retransmission attempts or the transport's retry window.

Choose delivery behavior

Delivery settings answer two questions: whether newer messages can bypass a delayed message, and when the transport should stop retrying delivery.

The publisher chooses one policy for each named channel. Every subscriber mirrors it. Use separate named channels for different policies, such as reliable commands and unreliable pointer updates:

• Reliable, ordered delivery (default): Omit ordered, maxRetransmits, and maxPacketLifeTime. Messages remain useful and must arrive in order.
• Reliable, unordered delivery: Set ordered: false; omit both retry fields. Messages remain useful, but later messages should not wait for earlier messages.
• No retries or ordering: Set ordered: false and maxRetransmits: 0. The application tolerates message loss and discards out-of-date updates.
• Limited retries: Set maxRetransmits: . Brief recovery is useful, but repeated retries are not.
• Time-limited transport retries: Set maxPacketLifeTime: . Limit how long the transport attempts transmission and retransmission.

Omitted ordered means true; ordering is independent of retries. Set at most one of maxRetransmits and maxPacketLifeTime. Omit both for reliable delivery, whether ordered or unordered. Setting maxRetransmits: 0 explicitly requests no retransmissions.

maxPacketLifeTime does not impose an end-to-end message-age deadline. Use application timestamps or sequence numbers to discard stale updates. Reliable delivery does not provide durable storage or confirm command execution.

Apply the policy end to end

Your application must supply the publisher's policy in every subscriber request and browser createDataChannel() call. Negotiated DataChannels do not communicate these settings to the browser automatically. Each endpoint uses its own allocated channel ID; waitForAck and canReply remain subscription-specific.

The shared policy applies to one named publication, so other channels in the same session or application can use different policies. Asymmetric reliability is outside the supported contract.

The following example configures unordered delivery with no retransmissions. It begins after you establish a DataChannel transport on both sessions and complete any required SDP exchange. Run the API requests from your backend with APP_ID, APP_TOKEN, PUBLISHER_SESSION_ID, and SUBSCRIBER_SESSION_ID set in your environment.

On the publisher session, create the local DataChannel:

curl --request POST \
--url "https://rtc.live.cloudflare.com/v1/apps/$APP_ID/sessions/$PUBLISHER_SESSION_ID/datachannels/new" \
--header "Authorization: Bearer $APP_TOKEN" \
--header "Content-Type: application/json" \
--data @- << EOF
{
  "dataChannels": [
    {
      "location": "local",
      "dataChannelName": "player-state",
      "ordered": false,
      "maxRetransmits": 0
    }
  ]
}
EOF

On each subscriber session, pull the remote DataChannel with the same delivery settings:

curl --request POST \
--url "https://rtc.live.cloudflare.com/v1/apps/$APP_ID/sessions/$SUBSCRIBER_SESSION_ID/datachannels/new" \
--header "Authorization: Bearer $APP_TOKEN" \
--header "Content-Type: application/json" \
--data @- << EOF
{
  "dataChannels": [
    {
      "location": "remote",
      "sessionId": "$PUBLISHER_SESSION_ID",
      "dataChannelName": "player-state",
      "ordered": false,
      "maxRetransmits": 0
    }
  ]
}
EOF

In the publisher and subscriber clients, create the negotiated browser DataChannel with the same settings. In this example, pc is the active RTCPeerConnection, and channelId is the ID returned by the corresponding API request:

const channel = pc.createDataChannel("player-state", {
  negotiated: true,
  id: channelId,
  ordered: false,
  maxRetransmits: 0,
});

Related documentation

• Realtime SFU overview
• DataChannels
• Connection API

You can now rotate the broadcast credentials for a Stream live input without changing the live input identifier.

Use key rotation when live input credentials may have been shared with the wrong audience, exposed in client code or a screenshare, or need to be refreshed as part of your security process. Rotating keys revokes the old credentials, disconnects broadcasts using stale credentials, and returns refreshed credentials in the API response.

To rotate keys for a live input, make a POST request to the rotate_keys endpoint:

curl --request POST \
https://api.cloudflare.com/client/v4/accounts/{account_id}/stream/live_inputs/{live_input_identifier}/rotate_keys \
--header "Authorization: Bearer <API_TOKEN>"

Live input responses now also include keysRotatedAt, which indicates when the live input keys were last rotated. This field is omitted for live inputs whose keys have never been rotated.

For endpoint details, refer to Rotate keys for a live input. For usage guidance, refer to Manage live inputs.

The Images binding is now billed per unique transformation, matching the model already used for URL-based transformations. Repeat requests for the same combination of source image and parameters within the same calendar month are counted only once.

Previously, every call to the binding counted as a separate transformation regardless of whether the image or parameters were unique. With this change, you can call the binding on hot paths without paying for each individual request.

Calls to .info() are no longer billed.

For more information, refer to Images pricing and the Images binding documentation.

Use the Images binding to upload, list, retrieve, update, and delete images stored in Images directly from your Worker without managing API tokens or making HTTP requests.

The env.IMAGES.hosted namespace supports the following storage and management operations:

• .upload(image, options) — Upload a new image to your account.
• .list(options) — List images with pagination.
• .image(imageId).details() — Get image metadata.
• .image(imageId).bytes() — Stream the original image bytes.
• .image(imageId).update(options) — Update metadata or access controls.
• .image(imageId).delete() — Delete an image.

For example, you can upload an image from a request body and return its metadata:

[TypeScript code example]

Or retrieve and serve the original bytes of a hosted image:

[TypeScript code example]

For more information, refer to the Images binding.

RealtimeKit lets you build products where people meet over live audio and video — such as HealthTech, EdTech, proctoring, and other real-time platforms — on Cloudflare's global WebRTC infrastructure.

Post-meeting transcription is now Generally Available

Post-meeting transcription is now Generally Available, so completed RealtimeKit meetings can automatically produce full transcript files after they end. Those transcripts can also power AI-generated summaries for meeting notes, review workflows, and follow-up tasks after the transcript is available.

Post-meeting transcription is a managed service powered by Workers AI using Whisper Large v3 Turbo. RealtimeKit handles transcription processing and can return transcript and summary files through webhooks or the REST API, so you do not need to run your own transcription infrastructure.

Generate transcripts and summaries by setting transcribe_on_end: true and summarize_on_end: true when creating a meeting.

Consume results via webhooks or REST API endpoints.

Supports CSV, JSON, SRT, and VTT transcript outputs, automatic language detection, Whisper language codes, and real-time transcription with Deepgram Nova-3 for live captions, in-meeting accessibility, and real-time note-taking.

Learn more in the RealtimeKit transcription docs and summary docs.

Cloudflare Realtime SFU is a WebRTC Selective Forwarding Unit that runs on Cloudflare's global network, so you can route live audio, video, and data between WebRTC clients around the world without managing SFU infrastructure or regions.

When you use the WebSocket adapter to stream WebRTC media to a WebSocket endpoint, the adapter now auto-reconnects and buffers audio and video after brief endpoint disconnects or restarts.

Many teams also use Realtime SFU as the media layer for backend applications, such as transcription, recording, note-taking, and agentic media-processing services. These systems often need to consume live WebRTC audio or video from the SFU in backend infrastructure, including Durable Objects, Workers, Containers, or external services, without running a WebRTC client themselves.

The WebSocket adapter bridges that gap by streaming WebRTC media from the SFU to a standard WebSocket endpoint as application-consumable payloads: PCM audio frames and JPEG video frames.

Reconnect behavior:

• Audio uses a short bounded backlog to reduce audible loss. If the interruption lasts longer than the backlog can cover, older audio may be dropped.
• Video resumes from the latest available JPEG frame instead of replaying stale frames.
• Recovery is best effort and does not guarantee gapless or exactly-once delivery.

If the endpoint remains unavailable after the 5-second reconnect window, the adapter closes and must be recreated.

Learn more in WebSocket adapter, Automatic reconnection for streaming, Get started with Realtime SFU, Realtime SFU example architecture, Realtime vs Regular SFUs, Global SFU Network Visualization.

You can now record specific participant audio tracks in RealtimeKit with track recording. Track recording creates separate WebM files for each participant instead of a single composite recording, which is useful for post-processing, transcription, and regulated or content-sensitive workflows.

To record specific participants, pass user_ids when starting a track recording.

Minimum SDK versions required for selective track recording:

• Web Core: @cloudflare/realtimekit version 1.4.0 or later
• Web UI Kit: @cloudflare/realtimekit-ui, @cloudflare/realtimekit-react-ui, or @cloudflare/realtimekit-angular-ui version 1.1.2 or later
• Android Core or iOS Core: version 2.0.0 or later
• Android UI Kit or iOS UI Kit: version 1.1.0 or later

RealtimeKit provides SDKs and UI components so that you can build your own meeting experience on Cloudflare's global WebRTC infrastructure. Teams today build products ranging from telehealth to education on RealtimeKit for global audiences. You can get started today with our Quickstart or take a look at our Cloudflare Meet repo as a reference.

Flows are automated rules that pair conditions (such as file extension, URL path, or query parameter) with parameters. Set up a flow to automatically apply image optimization to matching requests on your zone without writing code or changing URLs.

There are two modes for transformation flows:

• Provider flows — Migrate from another image optimization service. Your existing URLs continue to work while Cloudflare rewrites provider-specific parameters to their Cloudflare equivalents. Currently, Cloudflare supports provider flows for Fastly Image Optimizer.
• Custom flows — Define your own conditions and actions for use cases like automatic format conversion, responsive sizing with width=auto, or directory-based optimization.

To get started, go to Images > Transformations > Automation in the Cloudflare dashboard.

Learn more about transformation flows.

You can now interact with your Stream video library using new bindings for Workers!

This allows customers to upload content to Stream, provision direct uploads, manage videos, and generate signed URLs from a Worker without making authenticated API calls. We're excited to bring Stream and Workers closer together to empower more programmatic pipelines, tighter integrations, and support generative AI and inference workloads.

Use the Stream binding when you want to:

• Upload videos from URLs or create basic direct upload links for end users
• Generate signed playback tokens without managing signing keys
• Manage video metadata, captions, downloads, and watermarks
• Build video pipelines entirely within Workers

To get started, add the Stream binding to your Wrangler configuration.

Generate a video with AI and upload directly to Stream or send a URL of a file you already have.

Generate a signed URL without using a signing key or an API call.

Get and set video properties easily.

For setup instructions and the full API reference, refer to Bind to Workers API.

Get started with your Agent by adding a binding for Cloudflare Stream (env.STREAM). On the watch page, use the Stream binding to get info based on the ID, and leverage video.meta.name as the page title.

You can now use a Workers binding to transform videos with Media Transformations. This allows you to resize, crop, extract frames, and extract audio from videos stored anywhere, even in private locations like R2 buckets.

The Media Transformations binding is useful when you want to:

• Transform videos stored in private or protected sources
• Optimize videos and store the output directly back to R2 for re-use
• Extract still frames for classification or description with Workers AI
• Extract audio tracks for transcription using Workers AI

To get started, add the Media binding to your Wrangler configuration.

Then use the binding in your Worker to transform videos.

Output modes include video for optimized MP4 clips, frame for still images, spritesheet for multiple frames, and audio for M4A extraction.

For more information, refer to the Media Transformations binding documentation.

Real-time transcription in RealtimeKit now supports 10 languages with regional variants, powered by Deepgram Nova-3 running on Workers AI.

During a meeting, participant audio is routed through AI Gateway to Nova-3 on Workers AI — so transcription runs on Cloudflare's network end-to-end, reducing latency compared to routing through external speech-to-text services.

Set the language when creating a meeting via ai_config.transcription.language:

{
  "ai_config": {
    "transcription": {
      "language": "fr"
    }
  }
}

Supported languages include English, Spanish, French, German, Hindi, Russian, Portuguese, Japanese, Italian, and Dutch — with regional variants like en-AU, en-GB, en-IN, en-NZ, es-419, fr-CA, de-CH, pt-BR, and pt-PT. Use multi for automatic multilingual detection.

If you are building voice agents or real-time translation workflows, your agent can now transcribe in the caller's language natively — no extra services or routing logic needed.

See Transcription docs, Nova-3 model page, Workers AI, AI Gateway.

Cloudflare Workflows: Access current retry attempt

Cloudflare Workflows allows you to configure specific retry logic for each step in your workflow execution. Now, you can access which retry attempt is currently executing for calls to step.do() :

await
step.do(
"my-step",
async (ctx) =>
=>
{
// ctx.attempt is 1 on first try, 2 on first retry, etc.

console.log(`Attempt${${ctx.attempt}}`);
}
);

You can use the step context for improved logging & observability, progressive backoff, or conditional logic in your workflow definition.

Note that the current attempt number is 1-indexed. For more information on retry behavior, refer to
Sleeping and Retrying.