Herugrim

HERUGRIM

Sign in to Cloudflare Access with Discord. Keep your self-hosted apps behind the gate, and let through only the members of your server.

Deploy to Cloudflare Workers View on GitHub
The way in

Four steps through the gate

I

A traveller arrives

Someone opens one of your apps. Cloudflare Access stops them at the gate.

II

They give their name

They choose Discord, and Discord asks if Herugrim may know who they are.

III

The roll is checked

Are they of your server? Do they bear the admin role? Both are optional.

IV

The gate opens

Access lets them through, and your app is handed a signed token.

The seal

Their Discord name, signed and sealed

The token Access passes to your app carries a discord_user claim: who they are and whether they're an admin, without your app ever calling Discord.

{
  "discord_user": {
    "id": "80351110224678912",
    "username": "theoden",
    "global_name": "Théoden",
    "is_admin": true
  }
}
The keys

A few settings. No database.

CLIENT_ID · CLIENT_SECRET

From your Discord application. The secret is kept by Wrangler, never in the code.

REDIRECT_URI

Your Cloudflare Access callback address.

ALLOWED_GUILDS

Optional. Only members of these Discord servers may pass.

ADMIN_ROLE_ID

Optional. Bearers of this role are marked as admins, and the extra Discord permission is only asked for when it's set.