Cloudflare Workers with Keystatic

[eremannisto]

Is there active work on Cloudflare Workers support? The main blocker seems to be the OAuth flow failing on Cloudflare's runtime — both GitHub and Cloud mode appear affected based on issue #1497. What's the current status?

[burakgon]

As of 2026-07-20, the repository shows partial Cloudflare support, but no active fix for the GitHub OAuth failure in #1497 yet.

A few details narrow the current status down:

• Bug Report: OAuth State Not Generated on Cloudflare Pages (Astro 5.x) #1497 is still open and has no linked OAuth fix PR.
• fix(astro): read Cloudflare env via cloudflare:workers, not removed locals.runtime.env #1558 is active Cloudflare work, but it only adapts the Astro integration to Astro 6's removal of locals.runtime.env; it does not change OAuth.
• The missing state on the root login is intentional in the current handler. githubLogin() generates a state value, but when from === "/" it redirects without adding state or the ks-* cookie. Those are only added for a non-root return path. The callback also accepts a code without state. See generic.ts.
• This is unlikely to be a missing Web Crypto primitive: Cloudflare Workers supports crypto.getRandomValues().

That means the 401 in #1497 is probably later in the callback. In the current code, Authorization failed is returned only when GitHub's token endpoint is non-2xx or when the returned JSON does not match Keystatic's expected token shape: generic.ts. The most useful next diagnostic is therefore the token response status and a redacted response body, rather than the presence of OAuth state.

storage.kind === "cloud" follows a separate path and does not run this GitHub OAuth handler, so a Cloud-mode failure would need a separate reproduction from #1497.

So the short answer is: Astro/Cloudflare integration exists and Astro 6 compatibility is being worked on, but GitHub mode on Cloudflare is not confirmed fixed today. Cloud mode should not share this specific blocker.