Introduction
eetr-auth is a production-ready OAuth 2.1 and OpenID Connect authorization server that runs entirely on Cloudflare's edge — built to be forked as a template.
eetr-auth is a self-hostable OAuth 2.1 / OpenID Connect authorization server that runs entirely on Cloudflare's edge platform — no VMs, no containers, no origin servers. It ships as an npm monorepo you fork and deploy as a Cloudflare Workers template: two Workers, a D1 database, an R2 bucket, and a publishable TypeScript client library.
Built to be a Cloudflare template
This is not just a library — it is a deployable starting point. Fork the repo, point it at your Cloudflare account and domain, run the automated setup, and you have your own OAuth 2.1 / OIDC server on the edge in minutes. See Cloudflare template.
Architecture at a glance
What you get
Deploy in minutes
Terraform provisions D1 + R2; one command renders config, provisions secrets, applies the schema, deploys the Worker, and seeds an admin.
OAuth 2.1 + OIDC
Authorization Code + PKCE, Client Credentials, and Refresh Token with rotation. Full OIDC
discovery, JWKS, and /userinfo.
Modern auth
Argon2id passwords, WebAuthn passkeys, email OTP and authenticator-app (TOTP) MFA, and Google sign-in.
Edge-optimized hashing
Argon2id runs in an isolated Rust/Wasm Worker to keep expensive hashing off the main isolate's CPU budget.
MCP-ready
RFC 7591 Dynamic Client Registration lets MCP clients (Claude, ChatGPT) self-register — public, PKCE-only clients with resource-indicator audience binding.
Typed client library
@eetr/eetr-auth-client — discovery, token management, introspection, and JWT
validation for browser, Node, and Workers.
Feature highlights
| Category | Highlights |
|---|---|
| OAuth 2.1 | Authorization Code + PKCE (S256), Client Credentials, Refresh Token with rotation |
| OpenID Connect | OIDC discovery, JWKS endpoint, /userinfo, ID tokens (RS256) |
| Dynamic Client Registration | RFC 7591 self-registration for public clients (MCP-ready), rate-limited |
| Resource indicators | RFC 8707 resource audience binding on access tokens |
| Authentication | Password (Argon2id), passkeys (WebAuthn), Google sign-in |
| Multi-factor | Email OTP (site-wide) and authenticator-app TOTP (per-user, RFC 6238) |
| Admin | Dashboard for users, clients, tokens, audit log, site settings, password policies |
| Infrastructure | Cloudflare D1 (SQLite), R2 (object storage), Terraform provisioning |
Where to go next
Getting started
Prerequisites, quick start, and the full deployment walkthrough.
Architecture
Packages, layers, Cloudflare bindings, and the argon2id hashing worker.
Guides
Practical how-tos: MCP + DCR, WAF rate limiting, MFA/TOTP, and SPA integration.
Operations
Secrets and key rotation, maintenance, upgrades, and teardown.