XID
English | 简体中文 | 日本語 | 한국어 | Français | Deutsch | Español | Português (BR)
An edge-native identity platform deployed as three Cloudflare Workers from one codebase. The Core
Worker serves OIDC/OAuth, multi-tenant RBAC, enterprise SSO federation, Hosted Auth, and account
pages. A Nimbus Site Worker serves the complete localized documentation from the apex, while an
isolated Console Worker serves the management UI.
Project status
Pre-1.0. Until 1.0.0, public APIs, database schema, and package surfaces may still change without
a long deprecation window.
The hosted deployment at https://xid.dev is live. First-party Hosted Auth,
Console, Management API, and related core paths have production (L4) evidence against that
deployment (see docs/api-contracts.md and the pnpm run smoke:production*
gates). Broader coverage still rests on local L0–L3 unit, Workers-runtime, and browser or protocol
client tests.
Not production-supported until a real L4 row exists for that path: enterprise IdPs (Okta,
Microsoft Entra ID, and peers), downstream SaaS SSO/SCIM (Slack, GitHub Enterprise, and peers),
social OAuth with real provider secrets and callbacks, and SMS/WhatsApp delivery. Local
implementation or provider-ready is not a production-supported claim.
Evidence tiers (L0 to L4) and per-feature support levels live in
docs/protocols/README.md, which is authoritative over any summary here.
Why XID
Identity requests are latency-critical and globally distributed, yet most identity platforms answer
them from one region. XID puts the whole authorization server on Cloudflare's edge: token signing
runs on Web Crypto inside the isolate, session revocation is serialized by a per-user Durable
Object instead of a central database, and JWKS is cached in KV so relying parties verify tokens
without a round trip. Multi-tenancy is not an add-on either -- issuer, signing keys, WebAuthn RP ID,
and policy all resolve from a single TenantContext, so the same source tree runs as a zero-config
single-tenant deployment or a multi-tenant instance, by configuration rather than a build flag.
Features
Protocols and federation
- OIDC and OAuth 2.x authorization server with discovery, JWKS, protected-resource metadata,
/authorize, /token, /userinfo, /introspect, /revoke, /end_session, PAR, Device Flow,
Dynamic Client Registration, CIBA, hybrid responses, and front-channel, back-channel, and
session-management logout paths.
- Authorization code with mandatory PKCE S256, client credentials, rotating refresh tokens with
family replay revocation, and RFC 8693 token exchange. Resource Indicators, DPoP, mTLS, JAR,
JARM, RAR, and local Browser-Based Apps and FAPI 2.0 enforcement profiles are implemented.
- Enterprise SSO in both directions: inbound SAML 2.0 SP and OIDC RP federation, outbound SAML 2.0
IdP and OIDC applications for downstream SaaS, plus LDAP direct bind, WS-Federation, SWA password
vaulting, header-based SSO, and a directory connector framework.
- SCIM 2.0 Service Provider with Users, Groups, PATCH, filters, projection, sort, bulk, and
ETag/If-Match, plus outbound Users/Groups provisioning to downstream SaaS targets.
- OpenID Federation is limited to a minimal entity-metadata and registration boundary. Trust-chain
resolution, trust anchors, authority-hint traversal, and production interoperability are not
implemented.
Authentication and account lifecycle
- Passkeys/WebAuthn as the primary credential with discoverable credentials, mandatory user
verification, ES256/RS256/EdDSA verification, sign-count clone detection, and policy-driven
packed enterprise attestation validation.
- Passwords use Argon2id plus a server-side pepper held in Workers Secrets. Passwordless sign-in
supports magic links and one-time codes over email, SMS, and WhatsApp; social OAuth supports
Google, GitHub, Microsoft account, and Apple through the relying-party flow.
- MFA supports TOTP, SMS, passkey challenges, single-use backup codes, and OIDC AAL2 step-up bound
to the current session. AAL3 is explicitly not claimed.
- Guest sign-in provides Firebase-style lazy reuse and one-click in-place passkey upgrade with
sub preserved. Browser clients also have hidden-iframe prompt=none silent re-authentication
with a top-level redirect fallback.
- Invitation acceptance, email verification, top-level Tenant onboarding, active-Organization
selection, session management, and self-service credential management are implemented in Hosted
Auth and the account portal.
Organizations and authorization
This is the beginning of the README. Read the rest at the original. Read the full README ↗
