Just for clarity: Cloudflare runs authentik for their workforce identity. (source/disclosure: am CEO)

Glad to see them making use of Hydra for OAuth apps!