Prism

中文

A self-hosted OAuth 2.0 / OpenID Connect identity platform built on Cloudflare Workers. Deploy globally in minutes with zero servers.

Features

• OAuth 2.0 + OpenID Connect — authorization code + PKCE, RS256 ID tokens, introspection / revocation, UserInfo, Discovery, JWKS
• Step-up 2FA — server-initiated, action-pinned re-confirmation with sudo grace windows for sensitive operations
• Social & federated login — GitHub, Google, Microsoft, Discord, Telegram, X, Cloudflare, Generic OIDC, Generic OAuth 2 — multiple sources of the same type
• Multi-factor auth — multiple TOTP authenticators per account, passkeys (WebAuthn), GPG keys (incl. ML-DSA), backup codes
• Teams — shared ownership of OAuth apps and domains, roles, invites, transfer-ownership, site-floor join requirements
• App registry — users register and manage their own OAuth apps; admins can verify; cross-app permission scopes
• Domain verification — DNS TXT, HTML meta, or .well-known — pick per domain, auto re-verify
• Bot protection — Cloudflare Turnstile, hCaptcha, reCAPTCHA v3, GeeTest or Cap (proof-of-work); also gates 2FA confirmations
• Webhooks & notifications — user + admin webhooks, app event streams (webhook / SSE / WebSocket), email + Telegram notifications with a rule engine
• Public profiles — opt-in /u/<username> and /t/<team-id> pages with per-field visibility, GPG keys, GitHub README sync
• Encrypted at rest — AES-GCM envelope + keyed HMAC, rooted in a Cloudflare Secrets Store binding
• Admin panel — user/app/team moderation, audit log, login errors, full site config
• Customizable — site name, icon, accent color, custom CSS, email provider, captcha provider
• Edge-native + SSR — Cloudflare Workers + D1 + KV + R2, server-side rendered React 19, no servers

Stack

Layer	Technology
Runtime	Cloudflare Workers
Router	Hono v4
Database	Cloudflare D1 (SQLite)
Cache / Sessions	Cloudflare KV
File storage	Cloudflare R2
Frontend	React 19 + FluentUI v9
Routing	React Router v7
State	Zustand v5 + TanStack Query v5

Quick Start

You need Bun and a Cloudflare account (the free tier is enough).

git clone https://github.com/siiway/prism
cd prism/app
bun install
bun run setup

Setup signs you in to Cloudflare, asks for your URL, creates the database and storage, and deploys. Open your URL to create the admin account. See Getting Started for details.

To update, in app/: git pull, bun install, bun run deploy.

To work on Prism itself, see CONTRIBUTING.md.

Documentation

• Getting Started — full setup walkthrough

• Configuration — all site config keys + Wrangler bindings

• Admin Guide — managing users, apps, teams, and settings

• API Reference — REST API documentation

• OAuth / OIDC Guide — integrating Prism as an identity provider

• Teams — shared ownership of apps and domains

• Notifications — email and Telegram notification rules

• Webhooks and App Notifications

• Cross-App Permissions — exposing scopes to other apps

• Personal Access Tokens and Public Profiles

License

GNU General Public License 3.0, see LICENSE. Third-party licenses are in NOTICE.md.