Passkey sign-in for Cloudflare Workers, kept in one Durable Object

Server

Extend the Durable Object and export it. Every account lives in one instance, which is what makes an email belong to exactly one account. auth.handle answers everything under /auth/* and returns null for anything else.

// worker.ts
import { AuthDurableObject, createAuth, cloudflareEmail, rateLimitBinding }
  from "durable-auth/server";

export class Auth extends AuthDurableObject {}

export default {
  async fetch(req: Request, env: Env, ctx: ExecutionContext) {
    const auth = createAuth({
      store: env.AUTH,
      rpName: "My App",
      sendCode: cloudflareEmail(env.EMAIL, { from: "[email protected]", appName: "My App" }),
      rateLimit: rateLimitBinding(env.AUTH_LIMITER),
      waitUntil: (work) => ctx.waitUntil(work),
    });

    const handled = await auth.handle(req); // everything under /auth/*
    if (handled) return handled;

    const account = await auth.account(req); // your routes: who's signed in?
    if (!account) return new Response("Sign in first", { status: 401 });
    return new Response(`Hello, ${account.name}`);
  },
};

// wrangler.jsonc
{
  "durable_objects": { "bindings": [{ "name": "AUTH", "class_name": "Auth" }] },
  "migrations": [{ "tag": "v1", "new_sqlite_classes": ["Auth"] }],
  // Optional: recovery email (onboard the domain with `wrangler email sending enable`).
  "send_email": [{ "name": "EMAIL" }],
  // Optional: per-IP limits on the sign-in routes.
  "ratelimits": [{ "name": "AUTH_LIMITER", "namespace_id": "1001",
                   "simple": { "limit": 10, "period": 60 } }]
}

Onboarding a domain to Cloudflare Email Sending only adds records on a cf-bounce subdomain, so a domain whose mail is on Gmail or Workspace keeps working.

Client

Every call either returns what it promised or throws an AuthError with a message fit to show the user. authErrorMessage(e, fallback) returns null when the user simply dismissed the passkey prompt.

import { createAuthClient, authErrorMessage }
  from "durable-auth/client";

const auth = createAuthClient();

await auth.register("Sam");   // passkey prompt → account → signed in
await auth.signIn();          // passkey prompt, no username
await auth.session();         // Account | null (signed out) | undefined (offline)

await auth.startEmailVerification("[email protected]");
await auth.finishEmailVerification("[email protected]", "123456");

// On a new device, after losing the old one:
await auth.startRecovery("[email protected]");
await auth.finishRecovery("[email protected]", "123456");
await auth.addPasskey();      // recovery revoked the old passkeys

await auth.deleteAccount();   // may prompt for the passkey first (step-up)

Also: passkeys(), removePasskey(id), signOut(), signOutOtherDevices(), updateProfile(patch), config(), reauth(), and passkeysSupported(). Options: basePath (default "/auth") and timeoutMs (default 15 s). There's a runnable example: a 50-line Worker and a one-page script, via npm run example.