Identity at the edge, Handled.

Handled Cloud is a CDN-native Identity solution that works with your Identity Provider to handle session management, caching and origin configuration.

Sign up (opens in new tab)

The drift starts on day one.

Every team that touches identity in your organisation re-implements OAuth. The implementations drift apart the moment a new micro-frontend ships, a new API gateway is added, or a new identity provider is onboarded. Users get logged out unexpectedly. Tokens expire at the wrong time. Handled Cloud handles the session, OAuth, and token exchange at the Cloudflare edge, in one place, so the inconsistencies stop compounding.

How It Works

  1. 01

    Frontend uses a session cookie

    The browser is given a secure, httpOnly session cookie, which is managed by Handled Cloud, working with your Identity Provider.

  2. 02

    Handled Cloud swaps cookie for JWT

    At the edge, Handled Cloud validates the session cookie and reconstructs the token, forwarding this on to the configured origin.

  3. 03

    Request arrives at origin with JWT

    Your API receives a standard Bearer token to validate or introspect with your IDP, no changes needed.

One deployment. Every origin.

A single Handled Cloud deployment handles identity for every origin in your configuration: micro-frontends, API gateways, backend services. Add a new app by adding a route.

The session cookie is split between the browser and edge storage, so neither half is sufficient to reconstruct a token on its own.

Login, session, and token exchange in one deployment.

Login, session continuity, and post-quantum security, all in the same deployment.

One session across your domain.

Handled Cloud manages login, logout, and refresh via OIDC with your Identity Provider.

  • Login, logout and refresh at the edge
  • Post-quantum secure session
  • Any OIDC-compliant identity provider

Consistent Identity for your SPAs

When developing frontends, you typically need to implement Identity behaviours such as session timeout, logout and redirect-via-login. The browser needs to load your full JavaScript bundle before being routed elsewhere.

  • Session validated at the edge before the app bundle loads
  • Session timeout, logout, and redirect-via-login at the edge
  • Identity behaviour configured once across all applications

Cloudflare Native

Handled Cloud is an edge-native solution built on Cloudflare.

  • Deploy into your Cloudflare account or ours
  • Compatible with your existing Cloudflare Enterprise Agreement
  • Token exchange at the same edge node that received the request

Ready to handle identity at the edge?

Deploy in minutes into your Cloudflare account or ours. Works with any OIDC-compliant identity provider.

Sign up (opens in new tab)

or see how it deploys or email us