XID Identity Platform

XID brings Hosted Auth, passkeys, OIDC and OAuth, organizations, enterprise federation, SCIM, and SDKs into one identity platform built for Cloudflare.

Open source identity platform

XID brings Hosted Auth, passkeys, OIDC and OAuth, organizations, enterprise federation, SCIM, and SDKs into one identity platform built for Cloudflare.

One platform for identity

XID handles sign-in, authorization, organization membership, enterprise connections, and user lifecycle from one identity core. Applications use standards-based endpoints while teams manage the instance and every organization from one Console.

Run the same MIT-licensed codebase in single-tenant or multi-tenant mode on your Cloudflare account. Self-hosting includes every feature with no license check or separate edition.

XID is pre-1.0 and not production-ready. The documentation distinguishes local implementation evidence from real provider and SaaS verification.

What XID includes

Hosted Auth, passkeys, passwords, magic links, social sign-in, MFA, recovery, consent, and account self-service.
OIDC and OAuth 2.0, token issuance, discovery, JWKS, organizations, projects, applications, roles, and permissions.
Inbound enterprise SAML and OIDC, SCIM user and group provisioning, webhooks, audit records, and management APIs.
Browser, server, web framework, mobile, and desktop SDKs for integrating applications across the stack.

Explore XID

Product and setup

Getting started Connect an application to XID with OIDC discovery and Hosted Auth.
Hosted Auth Configure the unified sign-in and user creation flow.
Branding Customize the Hosted Auth appearance with colors, fonts, radius, logos, and custom CSS.
Self-hosting Run XID on your own Cloudflare account with Workers, D1, KV, R2, queues, and Durable Objects.

Identity protocols

OIDC and OAuth Discovery, authorization, token, logout, and OAuth extension endpoints.
Enterprise SSO Configure upstream enterprise IdPs and track downstream SaaS SSO boundaries without overstating production support.
Social login Configure social OAuth providers while keeping provider-ready separate from production support.
SCIM API reference SCIM 2.0 endpoint contract for provisioning users and groups into XID.
SAML SSO Connect enterprise identity providers using SAML 2.0.

APIs and operations

Management API Use scoped API keys to manage organization resources from your backend.
Webhooks Subscribe to XID events and receive signed HTTP payloads when users, sessions, and organizations change.

SDK overview

SDKs TypeScript packages and locally verified native SDKs for server, web, mobile, and desktop.

Server SDKs

@xid-kit/backend Networkless JWT verification, request authentication, and webhook signature validation for edge and server runtimes.
sdk/go Go server SDK for networkless JWT verification, request authentication, and webhook signature validation.
sdk/rust Async Rust server SDK for networkless JWT verification, request authentication, and webhook signature validation.
sdk/python Async Python server SDK for networkless JWT verification, request authentication, and webhook signature validation.
sdk/ruby Ruby server SDK for networkless JWT verification, Rack/Rails request authentication, and webhook signature validation.
sdk/php PHP 8.1+ server SDK for networkless JWT verification, PSR-7 request authentication, and webhook signature validation.
sdk/java Java 17+ server SDK for networkless JWT verification, HTTP request authentication, and webhook signature validation.
sdk/dotnet .NET 8 server SDK for networkless JWT verification, ASP.NET Core request authentication, and webhook signature validation.

Web SDKs

@xid-kit/core Browser client for session state, short-lived JWT access, and Management API helpers.
@xid-kit/react React 19 provider, hooks, control components, and hosted UI building blocks for customer applications.
@xid-kit/nextjs Next.js middleware, App Router and Pages Router server helpers, plus React SDK re-exports.
@xid-kit/vue Vue 3 plugin, composables, and headless components on top of @xid-kit/core.
@xid-kit/nuxt Nuxt 3 module with H3/Nitro server middleware and auto-imported Vue composables for SSR and full-stack apps.
@xid-kit/svelte Svelte 5 reactive stores and SvelteKit server hook for client and SSR authentication.
@xid-kit/solid SolidJS context provider, signal-based auth primitives, and headless components on top of @xid-kit/core.
@xid-kit/angular Angular 17+ standalone provider, RxJS service, functional route guards, and standalone components on top of @xid-kit/core.
@xid-kit/astro Astro integration with SSR middleware, server helpers, and island client singleton for static and server-rendered Astro sites.
@xid-kit/remix Remix loader and action server helpers, cookie session storage, and OAuth callback handler with React SDK re-exports.

Mobile SDKs

@xid-kit/react-native React Native provider and hooks for Hosted Auth redirect, PKCE S256, deep-link callback, and secure token storage adapters.
@xid-kit/expo Expo SecureStore and WebBrowser adapters for @xid-kit/react-native plus an Expo Router route guard hook.
sdk/ios Swift SDK for iOS and macOS using ASWebAuthenticationSession, PKCE S256 authorization code flow, and Keychain token storage.
sdk/android Kotlin SDK for Android using Chrome Custom Tabs, PKCE S256 authorization code flow, and Keystore-backed EncryptedSharedPreferences token storage.
sdk/flutter Dart / Flutter SDK for iOS, Android, and desktop using flutter_web_auth_2, PKCE S256 authorization code flow, and flutter_secure_storage token persistence.

Desktop SDKs

@xid-kit/electron Electron SDK with main process PKCE flow, contextBridge preload, OS keychain token storage, and loopback or custom-scheme callback strategies.
@xid-kit/tauri Tauri v2 desktop SDK with PKCE S256 flow, deeplink callback handler, OS keychain adapter, and Rust plugin template.
sdk/macos Swift SDK for macOS using ASWebAuthenticationSession, PKCE S256 authorization code flow, and Keychain token storage. Shares the implementation pattern with sdk/ios.
sdk/windows C# / .NET SDK for WinUI 3 applications using WebView2 for authorization, PKCE S256, and DPAPI-protected IsolatedStorage for token persistence.
sdk/linux Rust SDK for Linux desktop using xdg-open for browser launch, loopback TCP for the authorization callback, PKCE S256, and freedesktop.org Secret Service token storage.