edge-auth-worker

JWT authentication at the edge using Cloudflare Workers, Neon Postgres, and Cloudflare Worker AI. No cold starts. No Lambda. No JWKS round trips.

What it does

• Verifies JWT tokens at the edge using @tsndr/cloudflare-worker-jwt — zero dependencies, built specifically for Workers
• Stores sessions in Neon serverless Postgres via HTTP (no connection pooling needed)
• Runs an AI security audit of the auth implementation on demand via Cloudflare Worker AI (no API key required)

Use as a library

Install into your existing Cloudflare Worker:

npm install @pauxiel/edge-auth-worker

import { EdgeAuth } from '@pauxiel/edge-auth-worker';

const auth = new EdgeAuth({
  secret: env.JWT_SECRET,
  neonUrl: env.DATABASE_URL,
});

// Verify a Bearer token from the request
const user = await auth.verify(request);

// Or verify + store the session in Neon in one call
const user = await auth.verifyAndStore(request);

// Look up an existing session by token
const session = await auth.getSession(token);

verify extracts the Authorization: Bearer <token> header, validates the JWT, and returns a User object. It throws if the token is missing or invalid.

Deploy your own in one command

npx create-cloudflare@latest my-auth-worker --template pauxiel/edge-auth-worker

Then add your secrets:

cd my-auth-worker
npx wrangler secret put JWT_SECRET      # openssl rand -base64 32
npx wrangler secret put DATABASE_URL    # from neon.tech
npx wrangler deploy

That's it.

Manual setup

1. Clone and install

git clone https://github.com/pauxiel/edge-auth-worker
cd edge-auth-worker
npm install

2. Create Neon database

Go to neon.tech → create free account → create database named edge-auth → run:

CREATE TABLE sessions (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  user_id TEXT NOT NULL,
  email TEXT NOT NULL,
  token TEXT NOT NULL,
  expires_at TIMESTAMP NOT NULL,
  created_at TIMESTAMP DEFAULT NOW()
);

Copy the DATABASE_URL connection string.

3. Add secrets

npx wrangler secret put JWT_SECRET    # paste output of: openssl rand -base64 32
npx wrangler secret put DATABASE_URL  # paste your Neon connection string

4. Deploy

npx wrangler deploy

API

POST / — Verify token and store session

curl https://your-worker.workers.dev \
  -H "Authorization: Bearer <your-jwt>"

Returns 200 with user JSON on success, 401 on invalid/missing token.

GET /audit — AI security review

curl https://your-worker.workers.dev/audit

Runs the auth implementation through Cloudflare Worker AI (Llama 3.1) and returns a security review. No API key needed.

Project structure

src/
├── index.ts        # Worker entry point — routing + auth flow
├── types.ts        # Env + User interfaces
└── lib/
    ├── auth.ts     # JWT verification via @tsndr/cloudflare-worker-jwt
    ├── session.ts  # Neon session storage + retrieval
    └── ai.ts       # Worker AI security audit

Tech

| | | |---|---| | Runtime | Cloudflare Workers | | JWT | @tsndr/cloudflare-worker-jwt | | Database | Neon serverless Postgres | | AI | Cloudflare Worker AI — @cf/meta/llama-3.1-8b-instruct |

License

MIT