@anchrd/gate-api

@anchrd/gate-api

gate — login and permissions as a finished product. A Cloudflare Worker holds the logic, D1 holds everything as data. Deployable per customer, steerable from the outside over REST and MCP.

Built on Better Auth, Hono, Drizzle, and Zod.

Install

npm i @anchrd/gate-api

What it is

One question matters: can(interface, function) — may this user perform this action? gate holds users, roles, grants, registered interfaces, and an append-only audit log. A customer edge asks /api/v1/authorization once per request and gets back { identity, rules } — you never write code inside gate; everything is data.

The most convenient way to steer and consume gate is @anchrd/gate-sdk (client + gate CLI).

Setup (Cloudflare Worker)

The core is a factory (createGate(deps)); a thin worker shell injects the bindings. The ready-made ./cloudflare export is exactly that shell — your worker entry re-exports it:

// api.ts — your wrangler `main`
import worker from "@anchrd/gate-api/cloudflare";
export default worker;

// wrangler.jsonc
{
  "name": "gate",
  "main": "api.ts",
  "compatibility_flags": ["nodejs_compat"],
  "d1_databases": [{ "binding": "DB", "database_name": "gate" }],
  "ratelimits": [{ "name": "RATE_LIMIT", "simple": { "limit": 100, "period": 60 } }],
  "vars": {
    "BETTER_AUTH_URL": "https://gate.your-customer.dev",
    "GATE_ADMIN_EMAIL": "admin@your-customer.dev",
    "TURNSTILE_SITE_KEY": "1x…"
  }
}

Two secrets (not in vars):

wrangler secret put BETTER_AUTH_SECRET     # ≥ 32 bytes of randomness
wrangler secret put GATE_ADMIN_PASSWORD    # password for the bootstrap admin

Apply the migrations and deploy — the bootstrap seed creates the first admin from the env. Hosting elsewhere means swapping the ./cloudflare shell plus the db/mailer adapters; the core beneath knows no env.

Surface

Path
POST /api/v1/authorization	Bearer → { identity, rules } (service key; stamps "last seen").
GET /api/v1/schema	Everything registered, for codegen (gate init).
/api/v1/registry · /grants · /roles · /users	Administration (admin).
/api/v1/applications	Machine principals with scoped API keys (CI/CLI).
/mcp	The same administration actions as MCP tools.
/auth/* · /oauth2/* · /.well-known/*	Better Auth: login, OAuth provider, DCR, PKCE, discovery.
/health	Whether the gate itself is alive.

Two kinds of auth: authorization and schema accept the service key; everything else under /api/v1 requires a user bearer with admin rights (or an application key holding the admin role).

Related

• @anchrd/gate-sdk — the client and the gate CLI.
• @anchrd/gate-contract — the shared wire formats.