0 Get started
Passwordless auth for Cloudflare. Magic link, email OTP, Google, Apple. Mobile and web, both first-class. Built on Better Auth. No email/password, ever.
@pithy-sh/auth
pithy add authSomeone signs in, and every other capability can ask who they are. Magic link and email OTP by mail, Google and Apple by OAuth with PKCE and deep-link redirects.
Mobile and web are both first-class: bearer tokens for apps and SPAs, or cookie sessions for the web, with CSRF protection enabled alongside them.
What it sits on
Sessions and devices live in your D1. Short-lived access tokens are minted in your Worker and validated there; rotated refresh tokens sit in secure device storage. KV carries the fast-path lookups.
Built on Better Auth, so the parts that are solved stay solved.
The honest bit
This is a real constraint, not an oversight. Password auth means storage, rotation, breach response, reset flows, and a support burden that lands on you the first time someone forgets one.
If your product genuinely requires passwords, this module is the wrong choice and you should say so early rather than fight it.
If you build it yourself
Magic link and OTP look like two endpoints until you write the second one.
A refresh token used twice is either a replay attack or a client that retried. Telling those apart, and not logging out an honest user, is the part that takes a fortnight.
PKCE, deep-link redirects, and the universal-link edge cases where the browser hands control back to the wrong app — or to none.
Single-use, short-lived, constant-time compared, and rate-limited per address rather than per IP, or it is an enumeration oracle.
Bearer tokens for apps, cookies for the web, and CSRF protection that applies to exactly one of them.
Knowing which devices hold a live refresh token, and being able to revoke one without signing out the rest.
It is built on Better Auth, so the parts the ecosystem already solved stay solved, and what Pithy adds is the Cloudflare wiring and the mobile half.
pithy add authComposes with
In the dashboard
Every session, device and sign-in attempt your Worker recorded, readable without writing an admin screen.
The dashboard is the admin interface for your own application: whatever this capability writes, your team can look up, check and act on from a browser. Reading is free, forever, with no time limit. Connect the project when you deploy.
Everything else
Each one composes the same way. Nothing you skip costs you anything.
Designed, not shipped
Written down, argued out, and not built yet. Each one links to the issue it is being designed in, so you can read the reasoning or disagree with it.
One command installs the package, wires its bindings into every environment your project declares, and runs its migrations.