oakallow runs entirely on Cloudflare
- Cloudflare Workers handle authentication, API key verification, permission resolution, token minting, approvals, execution logging, billing, team management, support workflows, and the developer dashboard API.
- Cloudflare Pages serves the developer dashboard, documentation, and marketing site.
- Cloudflare D1 is the shared relational data store for permission and runtime data, and Cloudflare KV is used for fast key lookups, auth caching, and OAuth 2.1 grant storage.
- Cloudflare R2 stores support attachments.
User authentication is native. Passkeys (WebAuthn) and email one-time codes are issued, verified, and stored by oakallow itself, not by a third-party identity provider. Recovery codes are SHA-256 hashed and stored in our database.
The MCP connector (which integrates oakallow with Claude and ChatGPT) is also fully self-hosted. We run our own OAuth 2.1 authorization server on api.oakallow.io using the open-source @cloudflare/workers-oauth-provider library, with PKCE S256 required, refresh-token rotation, dynamic client registration, and a consent screen on our own domain. Compliance details are on our /docs/oauth page.
Supporting services such as Stripe (web billing), Apple StoreKit and Google Play Billing (mobile in-app purchases), Apple Push Notification Service and Firebase Cloud Messaging (mobile push), and Resend (transactional email) plug into that core architecture.
Internal service communication uses signed headers with a 30-second drift window for timing-safe validation where applicable.