workers-oauth-provider

I feel like the topic has been discussed ad nausiem but: * Software security - I.e. Mozilla blog post on using Mythos for software security [1] * Algorithms - AlphaEvolve makes real progress on matrix multiplication [2] * Open source - Backlog crushing in openvpn [3] * Corporate - CloudFlare Oauth workers [4] People are clearly using AI to ship real work that people end up using directly or indirectly. Projects like Godot are also in a weird spot though. [1]. https://blog.mozilla.org/en/privacy-security/ai-security-zer... [2] https://arxiv.org/abs/2506.13131 [3] https://stanislas.blog/2025/12/claude-code-opus-open-source-... [4] https://github.com/cloudflare/workers-oauth-provider

Reading the necessary RFC is table stakes. Instead we got this: >"NOOOOOOOO!!!! You can't just use an LLM to write an auth library!" >"haha gpus go brrr" (Those lines remain in the readme, even now: https://github.com/cloudflare/workers-oauth-provider?tab=rea...)

This goes back to how we define "novel problems." Is a dev building a typical CRUD webapp for some bespoke business purpose a "novel problem" or not? Reimplementing a well-known standard in a different language and infrastructure environment (e.g. https://github.com/cloudflare/workers-oauth-provider/)? I'm probably just rephrasing what you mean, but LLMs are very good at applying standard techniques ("common solutions"?) to new use-cases. My take is, in many cases, these new use-cases are unique enough to be a "novel problem." Otherwise, this pushes the definition of "novel problems" to something requiring entirely new techniques altogether. If so, I doubt if LLMs can solve these, but I am also pretty sure that 99.99999% of engineers cannot either.

https://github.com/cloudflare/workers-oauth-provider This library (including the schema documentation) was largely written with the help of Claude, the AI model by Anthropic. Claude's output was thoroughly reviewed by Cloudflare engineers with careful attention paid to security and compliance with standards. Many improvements were made on the initial output, mostly again by prompting Claude (and reviewing the results). Check out the commit history to see how Claude was prompted and what code it produced. "NOOOOOOOO!!!! You can't just use an LLM to write an auth library!" "haha gpus go brrr" In all seriousness, two months ago (January 2025), I (@kentonv) would have agreed. I was an AI skeptic. I thought LLMs were glorified Markov chain generators that didn't actually understand code and couldn't produce anything novel. I started this proje

Yeah OK fair that line in the readme is more prominent than I remember it being. I never look at my own readmes so they tend to get outdated. :/ Fixing: https://github.com/cloudflare/workers-oauth-provider/pull/59

Cloudflare's Oauth library probably handles some scale. https://github.com/cloudflare/workers-oauth-provider

I would like to see this list too. However, I guess people don't disclose they use AI when making stuff. AFAIK, this https://github.com/cloudflare/workers-oauth-provider repository is made with Claude code.

> So it kinda worked, but I would not use that for anything "mission critical" (whatever this means). It means projects like Cloudflare's new OAuth provider library. https://github.com/cloudflare/workers-oauth-provider > "This library (including the schema documentation) was largely written with the help of Claude, the AI model by Anthropic. Claude's output was thoroughly reviewed by Cloudflare engineers with careful attention paid to security and compliance with standards. Many improvements were made on the initial output, mostly again by prompting Claude (and reviewing the results)."

I get that a lot of folks wouldn't want to keep a log, but it makes me so sad that the wonderful aider 'ai peer' recommends adding aider logs of all sorts to the gitignore on startup. This feels bad for humans, and bad for AI sense-making too. If you are having this dialog, of course you'd want to be able to reflect on that, I'd think. It'd be neat to go further. Keeping the agent instructions alongside engineering docs feels like it makes sense. It'd be neat to see what one could do with Backstage like integration, to build out this existing wonderful corporate knowledge-base. Are there MCP servers yet that can reflect on chat history? Now I want to see a Backstage MCP server even more, one that's extensible by the many Backstage plugins! Shout out to Kenton Varda & cloudflare doing a nice job making a good commit history of AI use on th

To be fair, there was a pretty dumb CVE (which had already been found and fixed by the time the project made the rounds on HN): https://github.com/cloudflare/workers-oauth-provider/securit... You can certainly make the argument that this demonstrates risks of AI. But I kind of feel like the same bug could very easily have been made by a human coder too, and this is why we have code reviews and security reviews. This exact bug was actually on my list of things to check for in review, I even feel like I remember checking for it, and yet, evidently, I did not, which is pretty embarrassing for me.

We'll have to see how it pans out for Cloudflare. They published an oauth thing and all the prompts used to create it. https://github.com/cloudflare/workers-oauth-provider/

There's many examples of exactly what you're asking for, such as Kenton Varda's Cloudlfare oauth provider [1] and Simon Willison's tools [2]. I see a new blog post like this with detailed explanations of what they did pretty frequently, like Steve Klabnik's recent post [3], which while it isn't as detailed has a lot of very concrete facts. There's even more blog posts from prominent devs like antirez who talk about other things they're doing with AI like rubber ducking [4], if you're curious about how some people who say "I used Sonnet last week and it was great" are working, because not everyone uses it to write code - I personally don't because I care a lot about code style. [1]: https://github.com/cloudflare/workers-oauth-provider/ [2]: https://tools.simonwillison.net/ [3]: https://steveklabnik.com/writing/a-tale-of-two-claudes/ [4]: h

> A very good piece that clearly illustrates one of the dangers with LLS's: responsibility for code quality is blindly offloaded on the automatic system It does not illustrate that at all. > Claude's output was thoroughly reviewed by Cloudflare engineers with careful attention paid to security and compliance with standards. > To emphasize, *this is not "vibe coded"*. Every line was thoroughly reviewed and cross-referenced with relevant RFCs, by security experts with previous experience with those RFCs. — https://github.com/cloudflare/workers-oauth-provider The humans who worked on it very, very clearly took responsibility for code quality. That they didn’t get it 100% right does not mean that they “blindly offloaded responsibility”. Perhaps you can level that accusation at other people doing different things, but Cloudflare explicitly pla

The author goes into great detail about how he looked at my commit log[0] where I used AI, and he found it "nauseating" and concluded he'd never want to work that way. I'm certainly not going to tell anyone that they're wrong if they try AI and don't like it! But this guy... did not try it? He looked at a commit log, tried to imagine what my experience was like, and then decided he didn't like that? And then he wrote about it? Folks, it's really not that hard to actually try it. There is no learning curve. You just run the terminal app in your repo and you ask it to do things. Please, I beg you, before you go write walls of text about how much you hate the thing, actually try it, so that you actually have some idea what you're talking about. Six months ago, I myself imagined that I would hate AI-assisted coding! Then I tried it. I found o

> I found the experience of reading this commit history and imagining myself using such a tool — without exaggeration — nauseating. The commit history[1] looks like a totally normal commit history on page 1, but I clicked farther down and found commits like > Ask Claude to fix bug with token exchange callback when reusing refresh token. > As explained in the readme, when we rotate the refresh token, we still allow the previous refresh token to be used again, in case the new token is lost due to an error. However, in the previous commit, we hadn't properly updated the wrapped key to handle this case. > Claude also found that the behavior when `grantProps` was returend without `tokenProps` was confusing -- you'd expect the access token to have the new props, not the old. I agreed and had Claude update it. > Claude Code transcript: https://c