Melody Auth is an MIT-licensed, TypeScript-written OAuth 2.0 and authentication server that runs on both Cloudflare Workers and Node.js, and it is aimed at teams that want to host their own identity provider instead of renting one.

What it is

Melody Auth is a turnkey OAuth and authentication system for self-hosting. It ships an OAuth and authentication server, an admin panel that doubles as a full-stack implementation example, a server-to-server REST API for backend integrations, an embedded auth API for putting flows directly inside an application, and frontend SDKs for PKCE-based sign-in. The same project deploys to Cloudflare through Workers, D1, and KV, or self-hosts on Node.js with Redis and PostgreSQL.

The problem it solves is the work of implementing and hosting your own OAuth and authentication system. Instead of hand-rolling token exchange, session handling, per-provider social login glue, email verification, password reset, and multi-factor flows, a team configures one server that speaks OAuth 2.0 and OIDC and exposes those behaviours as endpoints: authorize, token exchange, refresh token revoke, app consent, app scopes, user info retrieval, and OpenID configuration. It replaces ad-hoc authentication code and the collection of provider-specific integrations that usually accumulate alongside it.

Key capabilities

• OAuth 2.0 and OIDC surface covering authorize, token exchange, refresh token revoke, app consent, app scopes, user info retrieval, and OpenID configuration.
• Authentication flows for sign-in, passwordless sign-in, sign-up, sign-out, email verification, and password reset.
• Multi-factor authentication with email MFA, OTP MFA, SMS MFA, MFA self enrollment, passkey enrollment, recovery codes, and remember device for 30 days.
• External identity providers: Google, Facebook, GitHub, Discord, and Apple sign-in, plus OIDC SSO and SAML SSO, the latter available in the Node.js environment only.
• Role-based access control, user attributes, account linking, localization, and organizations with per-organization branding override, organization users, and organization groups.
• Policies that gate flows, including sign_in_or_sign_up, update_info, change_password, change_email, reset_mfa, manage_passkey, manage_recovery_code, saml_sso_[idp_name], and oidc_sso_[provider_name].
• SDKs published as @melody-auth/react, @melody-auth/angular, @melody-auth/vue, and @melody-auth/web, alongside a server-to-server REST API and an embedded auth API, both documented with Swagger. Mail delivery goes through SendGrid, Mailgun, Brevo, Resend, Postmark, or SMTP (Node.js only), SMS through Twilio, and JWTs are RSA256-based.

Who uses it and how

• Cloudflare-first teams deploy the server to Workers with D1 and KV, which keeps infrastructure and DevOps overhead small.
• Teams that need full control over data and infrastructure self-host the Node.js stack with Redis and PostgreSQL.
• Product teams integrate PKCE-based sign-in into React, Angular, Vue, or plain web frontends through the published SDKs, and use the admin panel as a working reference implementation.
• Backend teams call the server-to-server REST API for integrations, or use the embedded auth API when authentication flows must live inside the application itself.
• Organizations with multi-tenant requirements use organization users, organization groups, per-organization branding, RBAC, and OIDC or SAML SSO for enterprise sign-in.

Getting started

Deploy to Cloudflare with Workers, D1, and KV, or self-host with Node.js, Redis, and PostgreSQL, following the setup documentation at auth.valuemelody.com. SDK packages install from npm under the @melody-auth scope.

How it compares

The facts provided name no paid products this project replaces and no comparable tools, so on the evidence available it stands alone in this registry rather than sitting in a field of documented alternatives. Its available comparison points are its own licence and deployment models: MIT-licensed, and runnable either on Cloudflare Workers or on a self-managed Node.js stack.

When to use it — and when not to

A self-hoster must operate PostgreSQL and Redis, or D1 and KV on Cloudflare, and must supply a mailer such as SendGrid, Mailgun, Brevo, Resend, Postmark, or SMTP, plus Twilio for SMS MFA. Teams that cannot run a database, a cache, and mail and SMS providers should not pick it, and anyone deploying on Cloudflare Workers gives up SAML SSO and SMTP, which are Node.js-only. Two further caveats are worth noting: the French translations in the project were AI-generated and the README advises reviewing them before use, and the README itself is largely a feature index that points to external documentation rather than a guided walkthrough.