auth-simple

Attach a Cloudflare Access application with a `preview_worker` destination to the Worker, which gates only preview URLs while production stays public. Create it account-level via `POST /accounts/{id}/access/apps` with type `self_hosted`, destinations, and inline policies.

Cloudflare Access is the production choice: free for 50 users, audited, and checked at the edge in front of the Worker. Cloudflare's own Basic Auth Worker example is explicitly labeled not suitable for production and requires nodejs_compat.

Yes, the Access check runs at the edge in front of the Worker and can gate paths like `/admin` on a static-assets-plus-Worker deployment, returning a 302 to the org login while sibling paths stay untouched. WebSocket connections are not supported by Worker-level Access policies.

It fails at runtime with a "dynamic require of stream" error unless the wrangler config sets the `nodejs_compat` compatibility flag and a 2025+ compatibility_date. Set both before debugging anything else.

Use Supabase Auth only when real users own real data, such as a client portal with per-user records — the free tier covers 50,000 monthly active users. For previews, staging, or admin surfaces, Access is strictly simpler and free.

A custom gate in front of static assets requires `run_worker_first`, so every matched request becomes a billed invocation against the shared 100k/day free cap with 429 failure risk. Access performs its check at the edge and avoids this billing trap.