Authrim

Authrim gives your own apps a login and single sign-on server that runs in your Cloudflare account. It issues OpenID Connect and OAuth 2.0 tokens, acts as a SAML 2.0 identity provider, and signs users in with passkeys, email codes, social logins or other identity providers. A setup wizard creates the Cloudflare resources and deploys it. The project is pre-1.0 and has not had a security audit.

The OpenID Connect side covers discovery, authorization, tokens, userinfo, introspection and revocation, plus PAR, DPoP, JAR, JARM, token exchange, the device flow and CIBA. The OpenID Foundation lists the maintainer's tests of Authrim 0.1.0 under its OpenID provider profiles and of 0.4.0 under FAPI 2.0. SAML 2.0 works both as an identity provider and as a service provider, with metadata import and export. Users sign in with passkeys, email one-time codes, social logins or external OIDC and SAML identity providers, and accounts can be linked. Access rules can be role-, attribute- or relationship-based and are checked through a real-time API. Users and groups can be provisioned in over SCIM 2.0, and one deployment serves several tenants with their own issuers. The Login UI covers sign-in, sign-up, consent and account pages in 21 languages. The Admin UI, in English and Japanese, manages clients, users, roles, organizations, SAML, login flows and audit logs. JavaScript SDKs cover web, server and SvelteKit apps. The setup tool, run with npx @authrim/setup, opens a local wizard that downloads the release, creates 6 D1 databases, 9 KV namespaces and 8 R2 buckets, generates the signing keys and secrets, and deploys 17 Workers with SQLite-backed Durable Objects to workers.dev. It ends with a one-time link for registering the first admin with a passkey. Updates run through the same tool.

Built for: Developers and small teams who want to run their own login and single sign-on server for their apps and can accept pre-1.0 software

An alternative to: Amazon Cognito, Auth0

What you can use it for

• Add login, sign-up and single sign-on to your own web apps without a per-user identity service
• Run one SSO login for internal tools over OpenID Connect or SAML
• Sign users in with passkeys and email codes instead of passwords
• Issue OAuth 2.0 tokens for your APIs from your own Cloudflare account

Deploy

• CLI

  The wizard downloads the release, creates the D1 databases, KV namespaces and R2 buckets, generates keys and secrets and deploys 17 Workers on workers.dev, then shows a one-time link to register the first admin with a passkey. Run it on macOS, Linux or WSL; pnpm 9 must be on PATH.

  corepack enable
  npx wrangler login
  npx @authrim/setup

  Copy
  Docs

Needs Node.js 22, pnpm 9 and a Wrangler login on macOS, Linux or WSL. The wizard asks for a one-time Cloudflare API token and does the rest.

What it needs to run

• R2 bucketsauthrim-audit-archive, authrim-diagnostic-logs, authrim-export-artifacts, authrim-import-artifacts, authrim-public-assets, authrim-sensitive-details

Good to know

Pre-1.0: APIs can change, and breaking database schema changes are expected until at least 0.5.0. There has been no formal security audit or penetration test, so test it thoroughly before it holds real accounts. A default install has 9 cron triggers, more than the 5 that Workers Free allows, so it needs Workers Paid. Each environment is 17 Workers, 6 D1 databases, 9 KV namespaces and 8 R2 buckets, and some updates require recreating the environment. Email codes and magic links need Resend or Cloudflare Email Sending. Tenant subdomains need a custom domain. Outbound SCIM provisioning is not supported. Run the setup on macOS, Linux or WSL; key generation fails on native Windows. One maintainer, who does not accept pull requests.

Cost on Cloudflare

Where this comes from

• Repositoryhttps://github.com/sgrastar/authrim
• App websitehttps://authrim.com
• Documentationhttps://authrim.com/getting-started/setup-wizard/