I built a Cloudflare Workers SaaS starter — auth, D1, rate limiting, no Auth0

Levani Gventsadze — Sat, 20 Jun 2026 08:55:19 +0000

Every time I start a project on Cloudflare Workers I end up rebuilding the same plumbing: sessions, a D1-backed API, rate limiting. So I packaged it into a small starter called EdgeKit (Hono + D1 + KV). Sharing the approach here in case it's useful.

Auth without an external bill

No Auth0, no per-MAU pricing — just PBKDF2 via Web Crypto (runs natively on Workers) plus sessions in KV:

const salt = crypto.getRandomValues(new Uint8Array(16));
const key = await crypto.subtle.importKey("raw", enc(password), "PBKDF2", false, ["deriveBits"]);
const bits = await crypto.subtle.deriveBits(
  { name: "PBKDF2", salt, iterations: 100_000, hash: "SHA-256" }, key, 256,
);
// store `pbkdf2$iters$salt$hash`; verify with a constant-time compare

The session token lives in an HttpOnly cookie and maps to a user id in KV with a TTL. Logout just deletes the KV key.

What's in it

Session auth (KV) + a tenant-scoped D1 CRUD API with migrations
A KV fixed-window rate limiter guarding the auth routes
Typed, tested, one-command wrangler deploy

Live demo (a real Worker you can hit): https://edgekit-storefront.xok.workers.dev

Happy to answer anything about the D1 schema or the rate-limiter design in the comments.

DEV Community: Levani Gventsadze

I built a Cloudflare Workers SaaS starter — auth, D1, rate limiting, no Auth0

Auth without an external bill

What's in it