AnyAuth
Passkey identity on Cloudflare Workers
The first-class Cloudflare-hosted IdP
Not just any auth, it's AnyAuth.
AnyAuth signs people in with passkeys instead of passwords, speaks OpenID Connect to your applications, keeps organizations and teams in order, and writes every event to an append-only audit trail. All of it on Cloudflare Workers.
Built in, not bolted on
The capabilities an identity provider owes you, shipped as one platform.
-
Passkeys, not passwords
Passwordless authentication built on WebAuthn. Daily sign-in is a passkey ceremony: phishing-resistant, bound to the device, quicker than any password form. There is no password column to breach.
-
An OIDC provider at the core
AnyAuth speaks OpenID Connect, with standard discovery and signed tokens, so applications, gateways, and clouds can all trust the same issuer.
-
Organizations and teams
Multi-tenant from the first record: organizations, teams, and memberships are first-class, ready for more than one company on a single install.
-
Append-only audit
Every sign-in and every administrative change is recorded in order and kept. History is written once, never rewritten, never trimmed.
-
Invite only
An admin creates the account and hands over a one-time enroll link. The invitee signs in and adds a passkey. There is no self-serve enroll.
-
Serverless by construction
The whole platform is Cloudflare Workers with D1 at rest: no origin servers, no patch cycle, and sign-in that runs close to every user on Cloudflare's network.
Cloudflare end to end
Even the CI is Cloudflare
AnyAuth does not just deploy to Cloudflare. It lives there. The product runs on Workers and D1, and the pipeline that builds the product is Cloudflare too, from the first commit to the running Worker.
-
01
Source
The code is hosted on Cloudflare Artifacts, git-native and in the same account that serves production.
-
02
Pipeline
CI/CD is not an outside service. It is built from Workers and Workflows, and it tests every push on the platform it ships to.
-
03
Ship
Green means live. Every push is tested and deployed, so what you see is never far behind what we wrote.
One network carries AnyAuth from commit to sign-in.
How we build
Flue specialists and an adversary
Those claims are the product. Flue agents review each change in parallel, one lens apiece: identity, workers, console, tests, and the pipeline. Each job gets the model that fits it. A validator may only disprove. An adversary takes a hostile second pass. That is how the cards above get true, then better.
Teams of focused agents, not one bot with a giant prompt.