Overview

What it is

Cloud Auth handles signing people in, and answers — for your own server — whether a given token still belongs to a real, current session. Accounts belong to tenants, a tenant is an organisation or a team, and the role somebody holds belongs to that membership rather than to the account.

Your users sign in with Google or Apple. There is no password to store, to leak, or to reset — the password step, where it exists at all, belongs to Google or Apple. The operator accounts that run the service do use a password, on a separate screen, and always with an authenticator app.

What happens when somebody signs in

Why it is built this way

• The browser never holds the token in reach of script: It is common to keep an access token in localStorage, which means any script that gets onto the page can read it. Here the session travels in a cookie the page's own JavaScript cannot see, with SameSite=Lax, the __Host- prefix, and an Origin check on top.
• A valid signature is not enough: Every request reads the session and the account out of the database. Without that, signing out, disabling an account or lowering a role would only take effect once the access token ran out — up to fifteen minutes later.
• Sessions live in D1: The session table is the authority on what is signed in. KV is used for rate limiting and for the short-lived state of an OAuth round trip, and holds no sessions.
• A second factor is asked for at the door, not at sign-in: Screens that reach personal data, and operations that cannot be undone, ask for a code at the moment they are used. A session that never opens them is never asked.