Your own OAuth 2.1& OpenID Connect server, on the edge
eetr-auth is a production-ready authorization server that runs entirely on Cloudflare Workers, D1, and R2. Fork it, point it at your domain, and deploy in minutes.
OAuth 2.1 + OIDC
Authorization Code + PKCE, Client Credentials, and Refresh Token with rotation. Full OIDC discovery, JWKS, and /userinfo.
Modern authentication
Argon2id passwords, WebAuthn passkeys, email OTP and authenticator-app (TOTP) MFA, and Google sign-in.
Edge-optimized hashing
Argon2id runs in an isolated Rust/Wasm Worker to keep expensive hashing off the main isolate’s CPU budget.
MCP-ready
RFC 7591 Dynamic Client Registration lets MCP clients self-register as public, PKCE-only clients with audience binding.
Typed client library
@eetr/eetr-auth-client — discovery, token management, introspection, and JWT validation for browser, Node, and Workers.
Resource indicators
RFC 8707 audience binding ties an access token to a specific protected resource, preserved through refresh rotation.
Argon2id in Rust, off the hot path
Cloudflare limits CPU per isolate invocation — the Free plan caps it at 10 ms per request, far less than a properly-tuned Argon2id hash needs. eetr-auth isolates hashing in a dedicated Rust/Wasm Worker so the auth Worker stays cheap on its hot paths, and the hasher gets its own raised CPU budget.
How the argon-hasher works[limits] cpu_ms = 30000 [[services]] binding = "ARGON_HASHER" service = "argon-hasher" [services.props] internal = true