forage409/authcore

★ 1TypeScriptAudience · developerComplexity · 4/5ActiveLicenseSetup · hard

Mindmap

mindmap
  root((authcore))
    Inputs
      User credentials
      OIDC requests
      Abuse reports
    Outputs
      JWT tokens
      Refresh tokens
      Userinfo responses
    Use Cases
      Self host Auth0 alternative
      Add SSO to multiple apps
      Block brute force attacks
      Account deletion with grace period
    Tech Stack
      TypeScript
      Cloudflare Workers
      Hono
      D1
      R2
      Resend
      JWT
      PBKDF2

mindmap root((authcore)) Inputs User credentials OIDC requests Abuse reports Outputs JWT tokens Refresh tokens Userinfo responses Use Cases Self host Auth0 alternative Add SSO to multiple apps Block brute force attacks Account deletion with grace period Tech Stack TypeScript Cloudflare Workers Hono D1 R2 Resend JWT PBKDF2

Things people build with this

USE CASE 1

Self host a free alternative to Auth0 or Clerk on a Cloudflare Workers account.

USE CASE 2

Spin up a new full stack starter with login wired in via npx create-nexus-auth.

USE CASE 3

Use AuthCore as an OpenID Connect provider for single sign on across several internal apps.

USE CASE 4

Add brute force lockout, IP allow lists, and a 14 day account deletion window to an existing app.

Tech stack

TypeScriptCloudflare WorkersHonoD1R2ResendJWT

Getting it running

Difficulty · hard Time to first run · 1h+

Needs a Cloudflare account with Workers, D1, R2, plus a Resend API key and wrangler migrations before login works.

MIT license, free to use, modify, and redistribute as long as the original copyright notice stays.

In plain English

AuthCore is an open source login system that you can run on Cloudflare Workers, which is a hosting service for small bits of code. It handles the parts of an app that deal with signing people up, logging them in, remembering them across visits, and blocking abusive users. The README pitches it as a self hosted alternative to paid services like Auth0 and Clerk, with the source code released under the MIT licence so anyone can read, copy, or change it. For a new project, the README shows two ways in. You can run a single command, npx create-nexus-auth my-app, which sets up a starter project with both the front end and back end wired together. Or you can install the SDK called nexus-auth-sdk into an existing app and call methods like register, login, and verifyAny. The SDK throws named errors such as AccountBannedError, so the calling code can react to specific problems without parsing text messages. The listed features cover the usual login flow plus several extras. Passwords are stored using PBKDF2 with 100 thousand iterations and a random salt. Sessions use a short lived JWT, valid for one hour, paired with a refresh token that lasts up to 30 days. There is full OpenID Connect support, meaning other apps can use AuthCore as a single sign on provider, with the consent page, token endpoints, and userinfo endpoint that the protocol expects. Brute force lockout, IP allow lists, a public abuse report endpoint, and a 14 day account deletion window are also built in. The code is laid out as a Cloudflare Worker called nexus-gateway, written with the Hono web framework in TypeScript, backed by Cloudflare D1 for the database and R2 for avatar storage. Email is sent through Resend. To self host it, the README walks through creating the D1 database and R2 bucket with wrangler, running SQL migration files in order, setting secrets for the JWT key and email API key, then deploying with wrangler deploy. A live playground and dashboard are linked for trying the system before installing anything.

Copy-paste prompts

Prompt 1

Run npx create-nexus-auth my-app and deploy the front and back end to my Cloudflare account end to end.

Prompt 2

Add nexus-auth-sdk to my existing Next.js app and wire register, login, and verifyAny calls to AuthCore.

Prompt 3

Provision the D1 database and R2 bucket for AuthCore with wrangler, run migrations in order, and set the JWT and Resend secrets.

Prompt 4

Configure AuthCore as an OpenID Connect provider for two of my apps and test the consent and token endpoints.

Prompt 5

Catch AccountBannedError and IP allowlist denials from nexus-auth-sdk and show user friendly messages in the UI.

Open on GitHub → Explain another repo

Generated 2026-05-22 · Model: sonnet-4-6 · Verify against the repo before relying on details.