D1 + KV + Workers. Email/password, magic links, OTP, and OAuth — production-grade authentication built entirely for the edge. No Node.js. No external services.
Session handling, D1 persistence, KV caching, and plugin integration for Cloudflare Workers.
Secure configuration for cookies, OAuth, magic links, and OTP flows.
Install
Pick your package manager or use an AI agent prompt to scaffold everything automatically.
npm install @gately/auth-core @gately/auth-clientSetup in 30 seconds
Create your auth instance, mount the handler. Every auth route — sign-up, sign-in, OTP, OAuth — is handled automatically.
import { gatelyAuth } from '@gately/auth-core'
import { createD1Adapter, createKVStore } from '@gately/auth-core/adapters'
import { gatelyEmail } from '@gately/auth-core/plugins'
export function createAuth(env: Env) {
return gatelyAuth({
secret: env.AUTH_SECRET,
db: createD1Adapter(env.AUTH_DB),
kv: createKVStore(env.AUTH_KV),
emailAndPassword: { enabled: true },
plugins: [gatelyEmail({ apiKey: env.GATELY_API_KEY })],
})
}import { createAuth } from './auth'
export default {
async fetch(req: Request, env: Env) {
const auth = createAuth(env)
// Mount all /auth/* routes
return auth.handler(req)
},
}
// Protect any route server-side
const session = await auth.api.getSession(req)
if (!session) return new Response('401', { status: 401 })Capabilities
All auth primitives designed for the Workers runtime.
Email + Password auth.
Sign up, sign in, email verification, and password reset — all configured in one object.
Magic links & OTP.
Passwordless sign-in via time-limited email links or 6-digit codes stored in KV.
Social sign-in.
Google, GitHub, and any OAuth 2.0 provider. PKCE, state validation, profile mapping.
D1 + KV native.
Users and sessions in Cloudflare D1. Magic links, OTPs, and rate limits in KV. No Postgres.
Plugin system.
Extend with custom endpoints, schema fields, and lifecycle hooks. Admin, usernames, One Tap included.
CLI + auto-provision.
Login to Cloudflare, auto-create D1 + KV, apply migrations, deploy — one command each.
API Surface
Mount on /auth/* and all endpoints are live immediately.
Extensible
Drop-in plugins that extend schema, routes, and email — without forking the core.
Gately Email
Connect to Gately's transactional email platform. Handles password reset, magic links, OTP, and verification automatically.
Admin Plugin
Protected /auth/admin/* endpoints for user listing, banning, session revocation, and deletion. X-Admin-Key required.
Username Plugin
Adds a unique username field to sign-up. Validation, uniqueness check, and a public availability endpoint included.
Google One Tap
Exchange a Google ID token for a gately-auth session — no redirect flow. Works with the One Tap JS snippet.
Social sign-in
Configure any OAuth 2.0 provider in one object. PKCE, state validation, and profile mapping handled automatically.
+ Any OAuth 2.0 / OIDC provider via socialProviders config
Roadmap
The next layer — build agents, MCP servers, CLI tools, and skills that connect directly to the Gately Auth platform.
Agent Framework
Build AI agents that authenticate on behalf of users. Session-aware, permission-scoped, deployable to Workers.
MCP Servers
Model Context Protocol servers for Gately Auth. Give AI assistants secure, authenticated access to your auth data.
Skills
Composable auth capabilities — "sign in with Google", "verify OTP", "get session" — that agents invoke directly.
Extended CLI
Agent-powered CLI. Describe what you need in plain language — the CLI scaffolds, migrates, and deploys for you.
Getting started
From install to a working auth Worker — in under 5 minutes.
01
Create your instance
Call gatelyAuth() with your D1 binding, KV namespace, and secret. One function, fully typed, zero globals.
02
Mount the handler
Route /auth/* to auth.handler(request). Works with Hono, plain Workers, itty-router, or any fetch handler.
03
Use the client SDK
Install @gately/auth-client in your frontend. React hooks, typed methods, automatic cookie/token management.
Compatibility
Monorepo
A focused set — nothing more, nothing less.
Get authentication running in your Cloudflare Worker in under 5 minutes. No account required to get started.