Quick start
The condensed happy path from clone to a running server and first login.
This is the fast path. For the authoritative walkthrough with checkpoints and troubleshooting, see Deployment.
1. Clone and install
git clone https://github.com/eetr-ai/eetr-auth.git
cd eetr-auth
npm install2. Authenticate to Cloudflare
Terraform and Wrangler both read a Cloudflare API token from the environment. Create a Custom token scoped to your account with D1 → Edit, Workers R2 Storage → Edit, Workers Scripts → Edit, and (optional) Account Settings → Read, then export it:
export CLOUDFLARE_API_TOKEN=your_token_here
export CLOUDFLARE_ACCOUNT_ID=your_account_id # same as account_id in terraform.tfvarsKeep both exported
Terraform, setup:remote, and Wrangler all reuse these. Set CLOUDFLARE_ACCOUNT_ID if your
token can access more than one account, or Wrangler may deploy to the wrong one (a code: 10000
error whose URL shows an unexpected account id).
3. Provision infrastructure
Fill in infra/terraform/terraform.tfvars (see Deployment
for each variable), then:
cd infra/terraform && terraform init && terraform apply && cd -4. Deploy the hasher, then run automated setup
argon-hasher must be deployed before the auth Worker:
npm run deploy:argon-hasher
npm run setup:remotenpm run setup:remote renders the Wrangler config, provisions secrets and JWT/JWKS material,
applies the fresh database schema, deploys the auth Worker, and seeds the bootstrap admin
(admin / admin).
5. Harden the bootstrap admin
Security-critical — do this immediately
The clean install seeds a well-known admin / admin account. After first login, either create
a real admin and delete the bootstrap account, or change its password and email. Never leave the
default credentials in place.
6. Smoke test
curl https://auth.yourdomain.com/api/health
# { "status": "ok" }Then sign in at your auth hostname and run npm run verify:remote to confirm the JWT signing key,
published JWKS, seeded OIDC scopes, and secrets are all consistent.