Three ways to run app identity.
You already run an identity provider. The question is who runs the session, OAuth, and token exchange on top of it: your teams, your IdP vendor, or a dedicated layer.
Sign up (opens in new tab)The same three questions per option.
01
Roll it yourself
- What you gain
- Complete control of the session layer, with no vendor platform in between.
- What it costs
- Browser session management is a specialist job, and every new application repeats it from scratch. The home page explains why implementations drift apart.
- What you own
- The session layer, in code your teams maintain, along with every failure mode that only surfaces in production.
02
Adopt your IdP's integrated identity platform
- What you gain
- A vendor-run session layer, so you do not sign up for a second vendor.
- What it costs
- Your application sessions live inside the vendor's stack, and you inherit its session model, roadmap, and pricing.
- What you own
- A session layer tied to that vendor: switching identity providers means re-working it, not re-pointing it.
03
A dedicated identity layer
- What you gain
- Switching identity providers is a configuration change, not a rewrite
- One deployment covers every app; a new app is a new route
- Origins receive standard JWTs, so application code stays clean
- The token exchange happens at the same edge node that received the request
- What it costs
- The layer is a runtime your identity provider does not supply, so it is the one piece of identity infrastructure you add.
- What you own
- Handled Cloud runs the layer on Cloudflare Workers in your own Cloudflare account; the control plane stays with us. Your identity provider stays the identity provider.
Ready to run a dedicated identity layer?
One deployment covers every app and environment you run.