Open-source auth that runs at the edge.

AuthHero is an OAuth and OpenID Connect server for your apps. Self-host it on Cloudflare in minutes, or let us run it for you.

Deploy it yourself

Already on Auth0? Your SDKs work with AuthHero.

Open source, all of it

Every line that touches your users' credentials is on GitHub under AGPLv3. Read it, audit it, run it yourself. No lock-in, ever.

Fast everywhere

Logins run on Cloudflare's network, in the data centre closest to each user. No region to be slow from, and no servers to patch.

Made in Europe

AuthHero is built by a European team. Self-host it on infrastructure you choose when data residency matters.

Your own auth server in about five minutes.

One command scaffolds a Cloudflare Workers project with its database migrations. Run it locally, then deploy it to your own Cloudflare account. The free tier is enough to run real apps.

Read the quickstart Star on GitHub

$ npx create-authhero my-auth
$ cd my-auth
$ npm run migrate
$ npm run dev

Ready  https://localhost:3000

Already using Auth0? Keep your code.

AuthHero implements the Auth0 Authentication and Management APIs, so auth0-spa-js, auth0-react and the rest work as they are. Import your users with their passwords, then point the SDK at your new domain.

Read the migration guide

src/auth.ts

const auth = new Auth0Client({

- domain: "acme.eu.auth0.com",

+ domain: "auth.acme.eu",

clientId: "YOUR_CLIENT_ID",

});

Everything a login needs.

Standards-based, so it fits whatever you already run.

Social and enterprise logins

Google, Apple, Microsoft, GitHub and any OIDC provider.

Passwordless

Email codes and magic links, alongside passwords.

OAuth 2.0 and OpenID Connect

Including silent auth, PKCE and dynamic client registration.

Safe refresh tokens

Rotation with reuse detection, so a stolen token stops working.

Account linking

One user, several ways to sign in.

Actions

Run your own code during login and sign-up.

Multi-tenant

Separate tenants per customer or environment.

GDPR tooling

Audit log and true erasure through crypto-shredding.

Run it yourself, or let us.

Self-hosted

Free

The full server, on your own Cloudflare account. Community support on GitHub.