OAuth Integrations for Edge Environments

Implement GitHub and Microsoft OAuth in Cloudflare Workers and other edge runtimes.

GitHub OAuth

Required Headers

GitHub API has strict requirements that differ from other providers.

typescript
1const resp = await fetch('https://api.github.com/user', {
2  headers: {
3    Authorization: `Bearer ${accessToken}`,
4    'User-Agent': 'MyApp/1.0',  // Required!
5    'Accept': 'application/vnd.github+json',
6  },
7});

Private Email Handling

GitHub users can set email to private (/user returns email: null).

typescript
1if (!userData.email) {
2  const emails = await fetch('https://api.github.com/user/emails', { headers })
3    .then(r => r.json());
4  userData.email = emails.find(e => e.primary && e.verified)?.email;
5}

Requires user:email scope.

Token Exchange

Token exchange returns form-encoded by default. Add Accept header for JSON:

typescript
1const tokenResponse = await fetch('https://github.com/login/oauth/access_token', {
2  method: 'POST',
3  headers: {
4    'Content-Type': 'application/x-www-form-urlencoded',
5    'Accept': 'application/json',  // Get JSON response
6  },
7  body: new URLSearchParams({ code, client_id, client_secret, redirect_uri }),
8});

GitHub OAuth Notes

Microsoft Entra (Azure AD) OAuth

Why MSAL Doesn't Work in Workers

MSAL.js depends on:

• Browser APIs (localStorage, sessionStorage, DOM)
• Node.js crypto module

Cloudflare's V8 isolate runtime has neither. Use manual OAuth instead:

1. Manual OAuth URL construction
2. Direct token exchange via fetch
3. JWT validation with jose library

Required Scopes

typescript
1// For user identity (email, name, profile picture)
2const scope = 'openid email profile User.Read';
3
4// For refresh tokens (long-lived sessions)
5const scope = 'openid email profile User.Read offline_access';

Critical: User.Read is required for Microsoft Graph /me endpoint. Without it, token exchange succeeds but user info fetch returns 403.

User Info Endpoint

typescript
1// Microsoft Graph /me endpoint
2const resp = await fetch('https://graph.microsoft.com/v1.0/me', {
3  headers: { Authorization: `Bearer ${accessToken}` },
4});
5
6// Email may be in different fields
7const email = data.mail || data.userPrincipalName;

Tenant Configuration

Azure Portal Setup

1. App Registration → New registration
2. Platform: Web (not SPA) for server-side OAuth
3. Redirect URIs: Add both /callback and /admin/callback
4. Certificates & secrets → New client secret

Token Lifetimes

Best Practice: Always request offline_access scope and implement refresh token flow for sessions longer than 1 hour.

Common Corrections

Error Reference

GitHub Errors

Microsoft Errors

Reference

• GitHub API: https://docs.github.com/en/rest
• GitHub OAuth: https://docs.github.com/en/apps/oauth-apps
• Microsoft Graph permissions: https://learn.microsoft.com/en-us/graph/permissions-reference
• AADSTS error codes: https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes