Cloudflare Passkey WebAuthn: Build $0 Auth Infrastructure

The Growth Boomerang: Auth SaaS Bill Shock

When startups and solo developers launch a new service, third-party authentication SaaS platforms like Auth0, Clerk, and Firebase Authentication are often the first tools they integrate.

They are the best choice for launching a prototype quickly while avoiding the risks of implementing password hashing, social logins (Google, Apple), and Multi-Factor Authentication (MFA) from scratch. However, the moment your service grows and Monthly Active Users (MAU) surpass 10,000 or 100,000, Auth SaaS turns into a terrifying “cloud bill bomb.”

[Popular Auth SaaS Cost Structures (As of 2026)]
- Auth0: B2C Pro Plan base $23/month + $0.07 per user above 10k MAU ($6,300+/month at 100k MAU)
- Clerk: Pro Plan base $25/month + $0.02 per user above 10k MAU ($1,800+/month at 100k MAU)
- Firebase Auth: Phone Auth & SMS infra costs $0.01–$0.06 per verification
---------------------------------------------------------------------
Result: A structural issue where user growth directly shrinks your margin per user

Even worse, every user login requires a round-trip to external Auth SaaS servers (often hosted in North America or Eastern Europe), adding 100ms to 300ms+ of network latency (RTT) and slowing down your application’s initial entry speed.

In 2026, the modern web and mobile ecosystem has adopted fingerprint and FaceID-based Passkey (WebAuthn / FIDO2) passwordless authentication as the standard. By pairing the Cloudflare Workers edge serverless runtime with the Web Crypto API (crypto.subtle), you can build a next-generation auth system with sub-5ms global latency and $0 infrastructure cost without paying a single dollar to third-party Auth SaaS providers.

This article covers everything from the pricing limitations of Auth SaaS and the internal workings of the Passkey (WebAuthn) authentication pipeline, to hands-on Cloudflare Workers + KV + D1 + Web Crypto integration code and security verification modules.

Auth SaaS vs. Cloudflare Native Passkey Architecture Comparison

How Passkey (WebAuthn) Works: Challenge-Based Public Key Cryptography

Passkeys leverage the secure chip (Secure Enclave / TPM) inside the user’s device (iPhone, Android, Mac, Windows). Instead of storing passwords, the server stores only the user’s Public Key in the database (Cloudflare D1).

+-----------------------------------------------------------------------------------+
| Passkey (WebAuthn) Login Flow                                                     |
+-----------------------------------------------------------------------------------+

[User (Biometrics)]         [Cloudflare Workers Edge]           [Cloudflare D1 DB]
         |                              |                                |
         |--- 1. Login Request -------->|                                |
         |                              |--- 2. Generate Random Challenge| (Stored in Workers KV)
         |<-- 3. Return Challenge ------|                                |
         |                              |                                |
  (Sign challenge via secure chip)      |                                |
         |                              |                                |
         |--- 4. Submit Signature ----->|                                |
         |                              |--- 5. Query Stored Public Key->|
         |                              |--- 6. Web Crypto Verify Sig    |
         |<-- 7. Auth Success (JWT) ----|                                |

1. Challenge Generation: The server generates a cryptographically random challenge and stores it in Workers KV with a 2-minute expiration.
2. Device Signature: Once the user authenticates via fingerprint or FaceID, the device signs the challenge using its Private Key.
3. Web Crypto Signature Verification: The server verifies the signature using the user’s Public Key stored in D1 via crypto.subtle.verify().
4. JWT Session Issuance: Upon successful verification, the server issues an HTTP-Only Cookie or Bearer JWT token.

Throughout this entire flow, zero passwords or sensitive secrets ever traverse the network.

Step 1: Storage Architecture (Cloudflare D1 + Workers KV)

We use two storage tiers for Passkey authentication:

• Workers KV: Stores single-use login challenges that automatically expire after 2 minutes (TTL) with ultra-low read/write latency.
• Cloudflare D1 (SQLite): Permanently stores user account data and Passkey credentials (Credential ID, Public Key, Sign Counter).

D1 Database Schema (schema.sql)

-- D1 Database Schema: schema.sql

-- Users Table
CREATE TABLE IF NOT EXISTS users (
    id TEXT PRIMARY KEY,
    email TEXT NOT NULL UNIQUE,
    name TEXT NOT NULL,
    created_at INTEGER NOT NULL
);

-- Passkey Credentials Table
CREATE TABLE IF NOT EXISTS passkey_credentials (
    id TEXT PRIMARY KEY,               -- Credential ID (Base64URL)
    user_id TEXT NOT NULL,
    public_key TEXT NOT NULL,          -- COSE / WebCrypto compatible public key (Base64)
    counter INTEGER NOT NULL DEFAULT 0,-- Signature counter to prevent clone attacks
    transports TEXT,                   -- 'internal', 'hybrid', 'ble', etc.
    created_at INTEGER NOT NULL,
    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
);

CREATE INDEX IF NOT EXISTS idx_credentials_user_id ON passkey_credentials(user_id);

Add bindings to wrangler.jsonc:

// wrangler.jsonc
{
  "$schema": "node_modules/wrangler/config-schema.json",
  "name": "edge-passkey-auth",
  "main": "src/index.ts",
  "compatibility_date": "2026-01-01",
  "compatibility_flags": ["nodejs_compat"],

  // 1. KV for temporary challenge storage
  "kv_namespaces": [
    {
      "binding": "AUTH_KV",
      "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    }
  ],

  // 2. D1 for persistent user and public key storage
  "d1_databases": [
    {
      "binding": "DB",
      "database_name": "passkey_db",
      "database_id": "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy"
    }
  ]
}

Step 2: Web Crypto API & Passkey Backend Implementation (Hono.js)

We build a lightweight backend combining the community standard @simplewebauthn library with Cloudflare’s native crypto.subtle.

Package Installation

npm install hono @simplewebauthn/server jose

Serverless Auth API Server (src/index.ts)

// src/index.ts
import { Hono } from "hono";
import { cors } from "hono/cors";
import {
  generateRegistrationOptions,
  verifyRegistrationResponse,
  generateAuthenticationOptions,
  verifyAuthenticationResponse,
} from "@simplewebauthn/server";
import { SignJWT, jwtVerify } from "jose";

type Env = {
  Bindings: {
    AUTH_KV: KVNamespace;
    DB: D1Database;
    JWT_SECRET: string;
  };
};

const app = new Hono<Env>();

app.use("*", cors({ origin: "*", credentials: true }));

const RP_NAME = "EffiDev App";
const RP_ID = "effidev.dev"; // Production domain
const ORIGIN = `https://${RP_ID}`;

// -------------------------------------------------------------------
// 1. Passkey Registration (Sign-up / Add Device) - Step 1: Generate Challenge
// -------------------------------------------------------------------
app.post("/api/auth/register/options", async (c) => {
  const { email, name } = await c.req.json();

  // Fetch or temporarily create user in D1
  let user = await c.env.DB.prepare("SELECT * FROM users WHERE email = ?").bind(email).first();
  const userId = user ? (user.id as string) : crypto.randomUUID();

  if (!user) {
    await c.env.DB.prepare(
      "INSERT INTO users (id, email, name, created_at) VALUES (?, ?, ?, ?)"
    ).bind(userId, email, name, Date.now()).run();
  }

  // Query existing registered Passkeys
  const credentials = await c.env.DB.prepare(
    "SELECT id FROM passkey_credentials WHERE user_id = ?"
  ).bind(userId).all();

  const excludeCredentials = credentials.results.map((cred) => ({
    id: cred.id as string,
    transports: ["internal" as const, "hybrid" as const],
  }));

  // Generate WebAuthn registration options
  const options = await generateRegistrationOptions({
    rpName: RP_NAME,
    rpID: RP_ID,
    userID: new TextEncoder().encode(userId),
    userName: email,
    userDisplayName: name,
    attestationType: "none",
    excludeCredentials,
    authenticatorSelection: {
      residentKey: "required",
      userVerification: "preferred",
    },
  });

  // Store challenge in KV (TTL: 2 minutes)
  await c.env.AUTH_KV.put(`reg_challenge:${userId}`, options.challenge, { expirationTtl: 120 });

  return c.json({ options, userId });
});

// -------------------------------------------------------------------
// 2. Passkey Registration - Step 2: Verify Device Signature & Save Public Key to D1
// -------------------------------------------------------------------
app.post("/api/auth/register/verify", async (c) => {
  const { userId, response } = await c.req.json();

  const expectedChallenge = await c.env.AUTH_KV.get(`reg_challenge:${userId}`);
  if (!expectedChallenge) {
    return c.json({ error: "Challenge expired or invalid" }, 400);
  }

  // Delete challenge immediately
  await c.env.AUTH_KV.delete(`reg_challenge:${userId}`);

  const verification = await verifyRegistrationResponse({
    response,
    expectedChallenge,
    expectedOrigin: ORIGIN,
    expectedRPID: RP_ID,
  });

  if (!verification.verified || !verification.registrationInfo) {
    return c.json({ error: "Registration verification failed" }, 400);
  }

  const { credential } = verification.registrationInfo;

  // Save public key to D1 (Base64 encoded)
  await c.env.DB.prepare(
    `INSERT INTO passkey_credentials (id, user_id, public_key, counter, created_at)
     VALUES (?, ?, ?, ?, ?)`
  ).bind(
    credential.id,
    userId,
    Buffer.from(credential.publicKey).toString("base64"),
    credential.counter,
    Date.now()
  ).run();

  return c.json({ success: true, message: "Passkey registered successfully" });
});

// -------------------------------------------------------------------
// 3. Passkey Login - Step 1: Issue Challenge
// -------------------------------------------------------------------
app.post("/api/auth/login/options", async (c) => {
  const options = await generateAuthenticationOptions({
    rpID: RP_ID,
    userVerification: "preferred",
  });

  const sessionChallengeId = crypto.randomUUID();
  await c.env.AUTH_KV.put(`auth_challenge:${sessionChallengeId}`, options.challenge, { expirationTtl: 120 });

  return c.json({ options, sessionChallengeId });
});

// -------------------------------------------------------------------
// 4. Passkey Login - Step 2: Verify Signature & Issue Sub-5ms JWT
// -------------------------------------------------------------------
app.post("/api/auth/login/verify", async (c) => {
  const { sessionChallengeId, response } = await c.req.json();

  const expectedChallenge = await c.env.AUTH_KV.get(`auth_challenge:${sessionChallengeId}`);
  if (!expectedChallenge) {
    return c.json({ error: "Challenge expired" }, 400);
  }
  await c.env.AUTH_KV.delete(`auth_challenge:${sessionChallengeId}`);

  // Query stored Passkey credential from D1
  const credRecord = await c.env.DB.prepare(
    "SELECT * FROM passkey_credentials WHERE id = ?"
  ).bind(response.id).first();

  if (!credRecord) {
    return c.json({ error: "Passkey not found" }, 404);
  }

  const publicKey = new Uint8Array(Buffer.from(credRecord.public_key as string, "base64"));

  // Verify signature
  const verification = await verifyAuthenticationResponse({
    response,
    expectedChallenge,
    expectedOrigin: ORIGIN,
    expectedRPID: RP_ID,
    credential: {
      id: credRecord.id as string,
      publicKey,
      counter: credRecord.counter as number,
    },
  });

  if (!verification.verified) {
    return c.json({ error: "Invalid signature" }, 401);
  }

  // Update counter to prevent clone attacks
  await c.env.DB.prepare(
    "UPDATE passkey_credentials SET counter = ? WHERE id = ?"
  ).bind(verification.authenticationInfo.newCounter, credRecord.id).run();

  // Issue sub-5ms JWT using jose powered by Web Crypto
  const secret = new TextEncoder().encode(c.env.JWT_SECRET || "fallback-secret-key-32-chars-min");
  const token = await new SignJWT({ userId: credRecord.user_id, role: "user" })
    .setProtectedHeader({ alg: "HS256" })
    .setIssuedAt()
    .setExpirationTime("7d")
    .sign(secret);

  return c.json({ success: true, token });
});

export default app;

Step 3: Frontend (Web / Flutter) Integration

Web Browser Client Code

Using the standard browser package @simplewebauthn/browser, triggering the fingerprint/FaceID biometric prompt takes just a single function call.

import { startRegistration, startAuthentication } from "@simplewebauthn/browser";

// 1. Passkey Registration
async function registerPasskey(email, name) {
  const optRes = await fetch("/api/auth/register/options", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ email, name }),
  });
  const { options, userId } = await optRes.json();

  // Trigger browser fingerprint/FaceID biometric prompt
  const attResp = await startRegistration(options);

  const verifyRes = await fetch("/api/auth/register/verify", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ userId, response: attResp }),
  });

  return await verifyRes.json();
}

// 2. Passkey 1-Second Seamless Login
async function loginWithPasskey() {
  const optRes = await fetch("/api/auth/login/options", { method: "POST" });
  const { options, sessionChallengeId } = await optRes.json();

  // Perform biometric authentication
  const asseResp = await startAuthentication(options);

  const verifyRes = await fetch("/api/auth/login/verify", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ sessionChallengeId, response: asseResp }),
  });

  const { token } = await verifyRes.json();
  localStorage.setItem("access_token", token);
}

Benchmark & Cost Savings Report

Here is a cost and performance comparison between a traditional Auth0/Clerk SaaS setup and a Cloudflare Native Passkey architecture for a mobile/web service with 100,000 Monthly Active Users (MAU).

Cost & Performance Comparison Table

By taking advantage of Cloudflare Workers’ Free tier (100,000 requests per day) or Paid tier ($5/month including 10 million requests), you can cut 100% of Auth SaaS costs—saving over $6,000/month.

Conclusion: Independent Serverless Security Architecture for 2026

Third-party Auth SaaS platforms are great for initial prototyping, but as your service scales, they turn into a heavy financial burden that squeezes your profit margins.

Combining Cloudflare Workers with Passkey (WebAuthn) delivers the following next-generation security benefits:

1. $0 Infrastructure Pipeline: Eliminates steep SaaS usage fees as your MAU scales.
2. Sub-5ms Ultra-Fast Latency: Direct verification at 300+ global edge data centers without external server round-trips.
3. Uncompromising Security: Passwordless architecture backed by Web Crypto API and secure hardware chips, completely immune to phishing attacks.
4. Complete Data Ownership: User accounts and public keys are safely stored in SQLite D1, preventing vendor lock-in.

Instead of paying monthly invoices to third-party authentication services, build a Cloudflare edge-native Passkey auth pipeline to achieve top-tier UX and maximum infrastructure efficiency.

Related post: Check out our Drizzle ORM + Cloudflare D1: Reduce Edge SQLite Bundle Size by 99% guide to learn how to design edge database schemas.