XID
English | 简体中文 | 日本語 | 한국어 | Français | Deutsch | Español | Português (BR)
An edge-native identity platform deployed as three Cloudflare Workers from one codebase. The Core
Worker serves OIDC/OAuth, multi-tenant RBAC, enterprise SSO federation, Hosted Auth, and account
pages. A Nimbus Site Worker serves the complete localized documentation from the apex, while an
isolated Console Worker serves the management UI.
Project status
Pre-1.0. Until 1.0.0, public APIs, database schema, and package surfaces may still change without
a long deprecation window.
The hosted deployment at https://xid.dev is live. First-party Hosted Auth,
Console, Management API, and related core paths have production (L4) evidence against that
deployment (see docs/api-contracts.md and the pnpm run smoke:production*
gates). Broader coverage still rests on local L0–L3 unit, Workers-runtime, and browser or protocol
client tests.
Not production-supported until a real L4 row exists for that path: enterprise IdPs (Okta,
Microsoft Entra ID, and peers), downstream SaaS SSO/SCIM (Slack, GitHub Enterprise, and peers),
social OAuth with real provider secrets and callbacks, and SMS/WhatsApp delivery. Local
implementation or provider-ready is not a production-supported claim.
Evidence tiers (L0 to L4) and per-feature support levels live in
docs/protocols/README.md, which is authoritative over any summary here.
Why XID
Identity requests are latency-critical and globally distributed, yet most identity platforms answer
them from one region. XID puts the whole authorization server on Cloudflare's edge: token signing
runs on Web Crypto inside the isolate, session revocation is serialized by a per-user Durable
Object instead of a central database, and JWKS is cached in KV so relying parties verify tokens
without a round trip. Multi-tenancy is not an add-on either -- issuer, signing keys, WebAuthn RP ID,
and policy all resolve from a single TenantContext, so the same source tree runs as a zero-config
single-tenant deployment or a multi-tenant instance, by configuration rather than a build flag.
Features
Protocols and federation
- OIDC and OAuth 2.x authorization server with discovery, JWKS, protected-resource metadata,
/authorize, /token, /userinfo, /introspect, /revoke, /end_session, PAR, Device Flow,
Dynamic Client Registration, CIBA, hybrid responses, and front-channel, back-channel, and
session-management logout paths.
- Authorization code with mandatory PKCE S256, client credentials, rotating refresh tokens with
family replay revocation, and RFC 8693 token exchange. Resource Indicators, DPoP, mTLS, JAR,
JARM, RAR, and local Browser-Based Apps and FAPI 2.0 enforcement profiles are implemented.
- Enterprise SSO in both directions: inbound SAML 2.0 SP and OIDC RP federation, outbound SAML 2.0
IdP and OIDC applications for downstream SaaS, plus LDAP direct bind, WS-Federation, SWA password
vaulting, header-based SSO, and a directory connector framework.
- SCIM 2.0 Service Provider with Users, Groups, PATCH, filters, projection, sort, bulk, and
ETag/If-Match, plus outbound Users/Groups provisioning to downstream SaaS targets.
- OpenID Federation is limited to a minimal entity-metadata and registration boundary. Trust-chain
resolution, trust anchors, authority-hint traversal, and production interoperability are not
implemented.
Authentication and account lifecycle
- Passkeys/WebAuthn as the primary credential with discoverable credentials, mandatory user
verification, ES256/RS256/EdDSA verification, sign-count clone detection, and policy-driven
packed enterprise attestation validation.
- Passwords use Argon2id plus a server-side pepper held in Workers Secrets. Passwordless sign-in
supports magic links and one-time codes over email, SMS, and WhatsApp; social OAuth supports
Google, GitHub, Microsoft account, and Apple through the relying-party flow.
- MFA supports TOTP, SMS, passkey challenges, single-use backup codes, and OIDC AAL2 step-up bound
to the current session. AAL3 is explicitly not claimed.
- Guest sign-in provides Firebase-style lazy reuse and one-click in-place passkey upgrade with
sub preserved. Browser clients also have hidden-iframe prompt=none silent re-authentication
with a top-level redirect fallback.
- Invitation acceptance, email verification, top-level Tenant onboarding, active-Organization
selection, session management, and self-service credential management are implemented in Hosted
Auth and the account portal.
Organizations and authorization
以上为 README 的开头部分。其余内容请阅读原文。 查看完整 README ↗
