loginbase

loginbase is a self-hosted authentication foundation designed to run inside Cloudflare Workers. It eliminates the need for external account servers or vendor dashboards by storing users, sessions, and login events directly in your own D1 database. The library provides passwordless sign-in with six-digit email codes, three layers of rate limiting, GitHub OAuth integration, and account linking. A Kotlin Multiplatform client (loginbase-kt) implements the remaining half of the authentication flow.

The architecture is intentionally minimal: no central auth server, no vendor dashboard, no migration projects when pricing changes. Instead, loginbase mounts into an existing Worker with your own D1 database, giving you full ownership over user data and session state. This removes the latency and security risks associated with redirecting users to external providers for verification.

The library also includes built-in analytics that track every authentication event—sign-ins, verifications, refreshes, revocations—with geographic context from Cloudflare's request.cf. These events land in a shared `auth_events` table alongside your client-side analytics, enabling funnel analysis without leaving your account. The design prioritizes developer experience: no token handling in app code, automatic session recovery on flaky network conditions, and silent failure modes that don't break tests.

Key features include six-digit email codes with enumeration-safe responses to prevent brute-force attacks, optional demo accounts for App Store review compliance without authentication bypasses, and a refresh token rotation mechanism that kills sessions on replay attempts. The system supports multiple sign-in providers (email, GitHub) while keeping the core logic contained within your own infrastructure.