Identity infrastructure for Cloudflare
Build identity at the edge, without giving up control
XID brings Hosted Auth, OIDC, organizations, enterprise federation, directory sync, and SDKs into one MIT-licensed platform running on Cloudflare Workers.
- License
- MIT
- Runtime
- 3 Workers
- Public locales
- 8
- Self-hosting
- Complete edition
The product surface
One control plane from sign-in to enterprise access
Use the complete platform or adopt the protocol, UI, and SDK layers that fit your architecture.
Hosted sign-in, passkeys, password, MFA, session management, consent, and account self-service share one tenant-aware Core.
Model organizations, OrgUnits, projects, roles, grants, approval policies, and access requests without creating a separate admin tenant.
Connect inbound SAML and OIDC, downstream SaaS SSO, SCIM, directory sync, and domain discovery behind explicit policy boundaries.
Ship OIDC and OAuth flows, Management APIs, webhooks, framework SDKs, localized docs, and networkless token verification from one repository.
One deployment model
Three focused Workers. One identity platform.
Public content and management stay binding-free. Identity state, protocols, and policy remain in Core.
- Site
- Product, documentation, search, and agent-readable content
- Console
- Organization and instance management UI
- Core
- Hosted Auth, protocols, APIs, data, and asynchronous work
Evidence and support
Production where proven, local where not
First-party Hosted Auth, Console, and Management API paths have production evidence on xid.dev. Enterprise IdP, downstream SaaS, social OAuth, and SMS or WhatsApp claims stay non-production-supported until a real L4 row exists for that path.
Inspect the protocol matrixOpen source, inspectable, and self-hostable
The MIT-licensed repository includes the complete feature set. Security posture and project governance remain visible through OpenSSF and the public source.
View source on GitHub