This library provides an OAuth 2.1 provider framework for Cloudflare Workers, enabling developers to easily add OAuth authorization to their APIs. It handles token management and user authentication, allowing developers to focus on their core API logic and UI implementation.

How It Works

The library acts as a wrapper around a Cloudflare Worker, intercepting requests to configured API routes. It validates access tokens and, upon success, passes the request to a designated API handler, injecting authenticated user details. The framework supports PKCE, dynamic client registration, and customizable token exchange callbacks for advanced scenarios. It leverages Cloudflare Workers KV for secure storage of token information, hashing secrets and encrypting user-specific props.

Quick Start & Requirements

• Install: npm install @cloudflare/workers-oauth-provider
• Prerequisites: Cloudflare Worker environment, Workers KV namespace binding named OAUTH_KV.
• Setup: Requires configuring API routes, handlers, and endpoints within the Worker.
• Docs: https://github.com/cloudflare/workers-oauth-provider

Highlighted Details

• Implements OAuth 2.1 provider with PKCE support.
• Handles token management and user authentication automatically.
• Stores secrets (tokens, client secrets) as hashes; props are encrypted.
• Supports dynamic client registration and token exchange callbacks.

Maintenance & Community

• Developed by Cloudflare engineers, with significant contributions from AI (Claude).
• Project is in beta (as of March 2025), with APIs subject to change.

Licensing & Compatibility

• License: Not explicitly stated in the README, but developed by Cloudflare. Compatibility for commercial use or closed-source linking is not detailed.

Limitations & Caveats

The library is in beta, meaning the API is subject to change. It currently implements a compromise for refresh token handling, allowing two valid refresh tokens per grant to mitigate transient failures, rather than strictly adhering to single-use or cryptographic binding as per OAuth 2.1 recommendations.