AUTHRIM

Identity & Access
at the edge of everywhere.

An open-source, OpenID Certified™ Identity & Access Platform for Cloudflare Workers — authentication, authorization, and federation on an edge-first architecture.

Get Started → View on GitHub
Apache 2.0 Open-source license
$0 Per-user fee
3,500 RPS Load-tested
OpenID Certified OP 7 profiles · Logout 4 profiles
Certified v0.1.0
Status

Pre-1.0. Core protocols are implemented; production hardening and validation are ongoing.

Capabilities

Built for the modern web.

01

Edge-Native

Built for Cloudflare Workers and Workers-native services. Run identity workloads near users while keeping deployment, scaling, and routing in your account.

  • Service Bindings architecture
  • Durable Object sharding
  • Setup-managed resources
02

Standards-Compliant

Certified OpenID Provider profiles, OAuth/OIDC extensions, SAML 2.0, SCIM 2.0, and WebAuthn / Passkeys for passwordless authentication.

  • OpenID Provider certification
  • PAR, DPoP, JAR, JARM
  • FAPI 2.0 controls
03

Self-Hostable

Open source under Apache 2.0. Deploy into your own Cloudflare account, inspect the source, and keep infrastructure decisions under your control.

  • Apache 2.0 license
  • Source-download setup
  • Pre-1.0 APIs may change
04

Policy Engine

Built-in RBAC, ABAC, and ReBAC authorization. Token-embedded permissions, runtime checks, and policy evaluation for tenant-scoped access control.

  • Zanzibar-style ReBAC
  • Real-time check API
  • Tenant-scoped policies
Data Boundaries

PII & Storage Boundaries

PII / non-PII separation, runtime storage profiles, and Hyperdrive-backed external database paths for supported user, custom, PII, and audit planes.

Read more →
Performance

Load-tested workloads.

3,500 RPS Token-oriented endpoints
150 logins / sec Full OAuth login flow
1–4 ms Typical CPU time
0 % errors In tested runs

K6 Cloud tests cover representative OIDC workloads; capacity depends on workload shape, Cloudflare plan limits, storage, and sharding.

Test reports →
Estimate

Estimate your cost.

Authrim has no per-user vendor fee — infrastructure cost depends on requests, CPU time, storage, and logging. A rough Cloudflare-cost reference, not a production quote.

Monthly Active Users 50,000
Service Type
Assumptions Weekly login, 10% DAU, 7-day session
Free / month
Requests ~1M
Per User Free
Workers: Free tier (100K/day)

Based on Cloudflare Workers pricing with a multiplier for KV, Durable Objects, and D1 from observed Authrim usage patterns.

Note — Infrastructure only. Excludes compliance, monitoring, support, operations, security review, external databases, and large R2/archive usage. Actual cost varies by deployment profile.

Protocols

Comprehensive protocol support.

OIDCCore
OAuth 2.0Core
SAML 2.0Enterprise
WebAuthnPasskeys
SCIM 2.0Provisioning
PKCESecurity
PARSecurity
DPoPSecurity
Device FlowIoT
CIBADecoupled
JWT BearerM2M
Token ExchangeRFC 8693
VC / DIDExperimental
Email CodePasswordless →
Who it's for

Built for flexible deployments.

A

Developers

TypeScript-first APIs, JavaScript SDKs, and a setup workflow for evaluating and developing edge identity deployments.

TypeScriptSDKsFast Setup
B

Enterprises

Self-hosted control with SAML, SCIM, audit logging, tenant boundaries, and storage / logging controls under active hardening.

SSOSCIMCompliance
C

Startups

Start on Cloudflare with no per-user Authrim fee, then scale based on measured request, CPU, storage, and logging behavior.

Free TierPay as GrowMeasured

Ready to get started?

Evaluate an open-source identity platform for Cloudflare Workers. Core protocol capabilities are implemented; production hardening is still active.

Read the Docs → Star on GitHub