Chinese version: zh-Hans/README.md
XID is a multi-tenant identity platform running on Cloudflare Workers: an OIDC/OAuth2 IdP, an organization model with RBAC, enterprise SSO federation (SAML/OIDC), SCIM directory sync, and passkey/WebAuthn. MIT licensed, and self-hosting gives you the complete feature set.
This directory holds the in-repository documentation. Pick an entry point by what you are trying to do.
Start with the SDKs, then read the protocol detail you need.
| Goal | Document |
|---|---|
| Is there an SDK for my language or framework | sdks/platform-matrix.md |
| Browser (vanilla or any framework) | sdks/web.md |
| React | sdks/react.md |
| Next.js | sdks/nextjs.md |
| Verifying tokens and webhooks on a server | sdks/backend.md |
| React Native | sdks/react-native.md |
| iOS | sdks/ios.md |
| macOS | sdks/macos.md |
| Android | sdks/android.md |
| Flutter | sdks/flutter.md |
| HTTP contract (calling the API without an SDK) | api-contracts.md |
The 13 native SDKs under sdk/ are published to no registry. They ship as source inside the repository; see the platform matrix.
docs/protocols/ binds every protocol capability to its standard source, support level, code path, test path and evidence level. "Support" has a strict definition there; it is not a marketing word.
| Goal | Document |
|---|---|
| Start here: how to read a support level | protocols/README.md |
| OAuth 2.x authorization server matrix | protocols/oauth.md |
| OIDC OP/RP matrix | protocols/oidc.md |
| SAML SSO matrix | protocols/saml.md |
| SCIM 2.0 matrix | protocols/scim.md |
| WebAuthn / passkey / MFA matrix | protocols/webauthn-passkeys.md |
| Token, key, session and cookie behaviour | protocols/tokens-sessions.md |
| FAPI / NIST / AAL / ACR / AMR | protocols/security-profiles.md |
| Per-IdP compatibility notes | protocols/provider-compatibility.md |
| Full capability to code and test mapping | protocols/source-map.md |
| Known gaps and what would close them | protocols/gap-audit.md |
| Official standard and provider source list | standards-sources.md |
docs/protocols/runbooks/ holds the per-provider runbooks, indexed in protocols/runbooks/README.md.
Upstream enterprise IdPs (sign in to XID with them):
- Microsoft Entra ID
- Okta
- Google Workspace
- OneLogin
- JumpCloud
- PingOne
- PingFederate
- AD FS
- Shibboleth
- Keycloak
Downstream SaaS (sign in to them with XID):
| Goal | Document |
|---|---|
| Deploy to Cloudflare from scratch | deployment.md |
| Evidence levels and commands (L0 to L4) | protocols/conformance-plan.md |
| What a DELETE endpoint really does | soft-delete.md |
| Goal | Document |
|---|---|
| OpenSSF Best Practices Passing form answers | openssf-best-practices.md |
| Vulnerability process and crypto summary | SECURITY.md |
| Contribution and testing policy | CONTRIBUTING.md |
| Community support channels | SUPPORT.md |
Before deploying, read at least the Secrets section of deployment.md: losing KEK or PEPPER is unrecoverable.
docs/design/ is the source of truth for product design, and records why each subsystem is built the way it is. Read the relevant chapter before changing an implementation; change the design there first. A Chinese mirror of all nine chapters lives in zh-Hans/design/; the English chapters are authoritative.
| Chapter | Contents |
|---|---|
| Design index | Overview of the nine chapters |
| 00 Overview | Positioning, license, stack, build-vs-buy boundary, TenantContext, domain model |
| 01 Authentication | Passkey, password, social, passwordless, MFA, anti-abuse |
| 02 Tenancy and RBAC | Organization model, membership, permissions, data isolation |
| 03 OIDC/OAuth | Endpoints, grants, tokens, advanced security, consent |
| 04 Enterprise SSO | SAML/OIDC federation, JIT, SCIM, SAML constraints on Workers |
| 05 Users and sessions | User model, sign-up and sign-in orchestration, GDPR, session management |
| 06 Developer experience | SDK layering, Management API, webhooks |
| 07 Platform operations | Console, branding, notifications, i18n, audit, metering |
| 08 Data model | D1 table inventory and isolation constraints |
For copy changes or adding a language, see i18n.md. Changing protocol behaviour requires updating protocols/source-map.md in the same change; CI has a gate for it.
MIT, copyright StringKe, 2026. Commercial use, closed-source use and redistribution are all permitted; the only obligation is to keep the copyright and license notice. Full terms are in LICENSE at the repository root.