id
An identity provider on the Cloudflare edge. Apps delegate sign-in to it and keep their own authorization: VibeCloud and Chan sign in through it, and TNT reports its sign-ins to it.
The problem
Per-project authentication means the same email-code, passkey and session code in every codebase, no single sign-on, and another auth implementation for every future native client.
How it works
- It runs on Workers only, with no container to operate. That ruled out Logto, Keycloak, Zitadel and Ory, so it is built from Hono, Better Auth, D1 and KV.
- Sign-in is by email code or passkey, plus Google or GitHub once configured. There are no passwords.
- Web apps send people through /sso/start and get back a signed ID token that they verify against the published JWKS. Native apps use separate /native endpoints.
- Discovery and JWKS are published, so adding an app means consuming a contract instead of copying auth code.
- One-time codes and rate limits live in D1, where they can be consumed atomically, and sessions use KV.
Built with
- Cloudflare Workers
- D1
- KV
- Hono
- Better Auth
- Drizzle
- WebAuthn