Threshold is a branded authentication gate that runs at the Cloudflare edge — a real login page in place of the browser's ugly HTTP-basic dialog. Unauthenticated visitors never receive your content. KV-backed sessions, bypass-token preview links, brute-force lockout, and sha-256 hashed passwords that never leave the edge.
This isn't an overlay hiding a page the browser already downloaded. The Worker withholds the origin bytes entirely until the visitor authenticates — an unauthenticated request never receives your content. Genuine gating, not a curtain over an open window.
Your logo, your headline, your accent — a designed login card instead of the browser's native HTTP-basic prompt that trips phishing alarms and looks broken. The first impression of a gated site can finally look like the brand behind it.
Share a ?threshold_token=XYZ link and the client walks straight in — no password to email, no "what was the login again?" The token mints a session, cleans the URL, and passes through. Perfect for sending staging to a stakeholder.
On paid tiers, hand out passwordless one-time links instead of a shared password. The visitor clicks, the token is consumed, a KV session is minted — and the link can't be reused. Cleaner for client access than circulating a credential.
Sessions are 32 random bytes stored in KV with a TTL (default 12h), set as an HttpOnly; Secure; SameSite=Lax cookie. Eight failed attempts in ten minutes locks that IP out — brute force gets nowhere at the edge.
The config holds only a sha-256 hash of the password — never the password itself, never in git, never in the Worker config. Login hashes the submission and compares at the edge. The secret never leaves the edge or touches your repo.
Bind the Worker route in front of the content you want gated — a subdomain like preview.acme.com, or ahead of a Pages project. DNS + route, not an embed snippet, because the gate intercepts the whole request.
Write a config to THRESHOLD_CONFIG KV keyed by hostname: the password's sha-256 hash, your branding, optional bypass tokens, and an optional origin to proxy after auth.
An unauthenticated request gets the designed login card and an HTTP 401 — never the origin bytes. Correct password mints a KV session and redirects them to exactly where they were headed.
Send a ?threshold_token=… URL and the client skips the password entirely — session minted, URL cleaned, straight through. Or, on paid tiers, issue a one-time /threshold/magic link.
Free is a real, working password door for one site. A license adds magic links, multi-site, custom CSS, and login logging.
Real protection. Threshold is a Cloudflare Worker that sits in front of the request — it withholds the origin bytes entirely until the visitor authenticates. An unauthenticated request gets the login card and a 401; it never receives your content. That's the opposite of a client-side overlay, which only hides a page the browser already downloaded (anyone can pop the dev tools and read it). Here, there's nothing to peek at because the bytes never left the edge.
HTTP-basic auth throws the browser's native dialog — ugly, unbranded, and notorious for tripping phishing warnings and looking broken to clients. Threshold serves a real, designed login page at the edge with your logo, headline, and accent color, plus proper KV sessions, bypass tokens, magic links, and brute-force lockout. Same level of "you can't get in without the secret," a vastly better door.
No. In the standalone mode the Worker is bound to the protected hostname and, after auth, proxies content from a configured origin — or serves its own bundled demo page if you don't set one. It runs entirely at the edge, so it's a natural fit for static builds, Cloudflare Pages projects, or any HTTP origin you want gated. No box to keep alive.
Send them a ?threshold_token=… link. The token mints a session, cleans the URL, and passes them straight through — no password to email, no "what was the login again?" On paid tiers you can issue one-time magic links instead, which can't be reused once clicked. Either way the client walks in without you handing out a shared credential.
Only as a sha-256 hash, in KV, per site — never in plaintext, never in git, never in the Worker config. At login the submission is hashed and compared at the edge with a length check. Sessions are 32 random bytes in KV with a TTL (default 12h), set as an HttpOnly; Secure; SameSite=Lax cookie. For very high-stakes auth, pair Threshold with Cloudflare Access for true IdP SSO — Threshold is the branded password/preview door, not an enterprise SSO replacement.
The pattern is proven. Threshold productizes the same edge auth gate already running in front of live client sites — a real, in-production guard — packaged with branding, bypass tokens, magic links, and license tiers. It's the right tool for staging sites, client previews, and light-touch internal tools where you want a beautiful, genuinely-closed door without standing up a server.