Cloudflare

​

Setup

https://your-app.com/api/theauth/auth/oauth/callback/cloudflare

import { createTheAuth } from '@glinr/theauth';
import { oauth, createCloudflareProvider } from '@glinr/theauth/auth';

const theauth = await createTheAuth({
  database: { provider: 'sqlite-native', url: 'theauth.db' },
  secret: process.env.THEAUTH_SECRET!,
  baseUrl: 'https://your-app.com/api/theauth',
  auth: { session: { secret: process.env.THEAUTH_SECRET! } },
  plugins: [
    oauth({
      providers: {
        cloudflare: createCloudflareProvider({
          clientId: process.env.CLOUDFLARE_CLIENT_ID!,
          clientSecret: process.env.CLOUDFLARE_CLIENT_SECRET!,
        }),
      },
    }),
  ],
});

CLOUDFLARE_CLIENT_ID=...
CLOUDFLARE_CLIENT_SECRET=...

​

Scopes

​

How it works

• Authorization Code flow with PKCE (S256). The endpoints are https://dash.cloudflare.com/oauth2/auth and https://dash.cloudflare.com/oauth2/token.
• Client credentials go in an Authorization: Basic header by default. If the client is registered for client_secret_post, pass tokenEndpointAuthMethod: 'client_secret_post'.
• Cloudflare’s OIDC userinfo endpoint returns only sub, so the profile is read from GET https://api.cloudflare.com/client/v4/user. The answer is wrapped in { success, errors, result }. The name is first_name and last_name joined, with the email as the fallback. There is no avatar.
• /user does not say whether the email is verified, so the OAuth plugin will not link a Cloudflare login to an existing account by email.
• Clients without a secret (token auth method none) are not supported by this provider.

​

Endpoints