Cloudflare Platform Limits & Cost

Authrim runs entirely on Cloudflare Workers. This page documents the platform limits that affect Authrim’s operation and provides cost estimates for various usage scales.

Key Limits at a Glance

50 / 1,000

External Fetch Subrequests

Free plan: 50 per invocation. Paid plan: 1,000 per invocation.

1,000

Internal Service Calls

KV, DO, D1 calls per invocation — all plans.

10–30

Typical Internal Calls

Authrim’s typical internal subrequest count per single request.

$5/mo

Workers Paid Plan Base

Minimum monthly cost for Workers Paid Plan.

Subrequest Limits

Cloudflare Workers impose two distinct categories of subrequest limits:

Category	Free Plan	Paid Plan	Counted Operations
External fetch	50 / invocation	1,000 / invocation	`fetch()` to external origins
Internal service	1,000 / invocation	1,000 / invocation	KV, DO, D1, R2, Queues, etc.

Key distinction: External fetch limits apply only to outbound HTTP requests to external origins. Internal service bindings (KV reads/writes, DO requests, D1 queries) have their own separate 1,000-call limit that applies equally across all plans.

flowchart LR
    W["Worker Invocation"]
    subgraph external["External Fetch (50/1,000)"]
        EF1["IdP Token Endpoint"]
        EF2["IdP UserInfo"]
        EF3["JWKS Fetch"]
    end
    subgraph internal["Internal Service (1,000)"]
        KV["KV Storage"]
        DO["Durable Objects"]
        D1["D1 Database"]
    end
    W -->|"fetch()"| external
    W -->|"binding"| internal

Authrim typically uses 10–30 internal service calls per request, well within the 1,000 limit. External fetches are only required during IdP federation flows (callback, token exchange with external providers).

Per-Flow Subrequest Analysis

Authorization endpoint — initiates the OAuth flow.

Resource	Count	Description
External HTTP	0–2	JWKS fetch (if cache miss), IdP redirect
KV	3–5	Session lookup, client config, OIDC metadata
DO	1–2	Session validation, auth code creation
D1	2–4	User lookup, consent check
Total	6–13

OAuth callback — processes the response from external IdP.

Resource	Count	Description
External HTTP	4–6	Token exchange, UserInfo, JWKS, emails API
KV	3–5	State validation, client config, user cache
DO	2–3	Session creation, auth code issuance
D1	3–5	User create/update, consent, grant records
Total	12–19

This flow has the highest external fetch count due to IdP communication. On Free plan (50 limit), this is safe but leaves less headroom.

Token endpoint — code exchange, refresh, client credentials.

Resource	Count	Description
External HTTP	0–1	JWKS fetch (rare, cache miss)
KV	3–5	Client auth, token metadata, JWKS cache
DO	2–4	Auth code validation, refresh token rotation
D1	3–5	Grant lookup, token persistence, user data
Total	8–15

Admin API — user, client, role, and policy management.

Resource	Count	Description
External HTTP	0–2	Webhook notifications, SCIM sync
KV	2–5	Config cache, RBAC cache
DO	0–1	Rate limiting
D1	3–8	CRUD operations (varies by endpoint)
Total	5–16

OIDC Backchannel Logout — propagates logout to RPs.

Resource	Count	Description
External HTTP	1–2	Logout token delivery to RPs
KV	2–3	Session lookup, RP config
DO	1–2	Session invalidation
D1	2–3	Session cleanup, audit log
Total	6–10

Risk Areas

Pricing Reference

Cloudflare Workers Paid Plan ($5/month base) pricing:

Service	Free Tier Included	Overage Rate
Workers requests	10M/month	$0.30 per million
KV reads	10M/month	$0.50 per million
KV writes	1M/month	$5.00 per million
D1 rows read	25B/month	$0.001 per million
D1 rows written	50M/month	$1.00 per million
DO requests	1M/month	$0.15 per million
DO duration	400K GB-s/month	$12.50 per million GB-s

Cost Model

Usage Patterns

Metric	Light (internal tools)	Standard (typical web app)	Heavy (SPA/mobile)
Logins/MAU/mo	4	8	15
Silent Auth/Login	5	10	20
Refresh/Login	2	3	6
API Calls/Login	2	5	10
Requests/MAU/mo	36	152	555

Cost Estimates

	Light	Standard	Heavy
Total Requests	360K	1.52M	5.55M
Workers	$5.00	$5.00	$5.00
KV	$0.00	$0.00	$0.00
DO	$0.00	$0.08	$0.68
D1	$0.00	$0.00	$0.00
Monthly	~$5	~$5	~$6

All usage falls within free tiers at this scale. Only Workers base cost applies.

	Light	Standard	Heavy
Total Requests	3.6M	15.2M	55.5M
Workers	$5.00	$6.56	$18.65
KV	~$1	~$18	~$95
DO	$0.39	$3.43	$13.35
D1	$0.00	$0.00	$0.00
Monthly	~$6	~$33	~$132

KV writes become the primary cost driver at this scale.

	Light	Standard	Heavy
Total Requests	36M	152M	555M
Workers	$12.80	$47.60	$168.50
KV	~$26	~$223	~$890
DO	$5.15	$44.45	$163.35
D1	$0.00	$0.00	$0.00
Monthly	~$49	~$320	~$1,227

At 1M MAU, KV write costs dominate. D1 typically stays within the 25B rows/month free tier.

Interactive Cost Calculator

Monthly Active Users (MAU)

10,000

Logins / MAU / month

Silent Auth / Login

Token Refresh / Login

API Calls / Login

SSO Services

$5.00 /month

Per User $0.0005

Total Requests/mo 1.5M

Workers $5.00

KV Total $0.00

KV Reads $0.00

KV Writes $0.00

Durable Objects $0.00

D1 Database $0.00

Optimization Tips

Use Paid Plan — The Free plan’s 50 external fetch limit risks failure on OAuth callback flows. Paid plan ($5/month) raises this to 1,000.
Minimize KV writes — KV write costs ($5/million) are 10x higher than reads ($0.50/million). Cache aggressively and batch updates where possible.
Manage IAT token count — Limit active tokens per user to prevent unbounded KV.list() + KV.get() chains.
Leverage JWKS caching — Authrim caches JWKS keys in Durable Objects, avoiding repeated external fetches. Ensure cache TTL is configured appropriately.
Monitor DO request volume — Durable Object requests scale with authentication traffic. Use sharding to distribute load and monitor shard utilization.