This example Worker sits in front of ripgit, handles GitHub OAuth, issues browser session cookies, mints long-lived tokens, and forwards trusted X-Ripgit-Actor-* headers to the main ripgit Worker through a Service Binding.

• GET / - landing page for browsers plus text mode for curl/agents
• GET /settings - token management page after sign-in plus text mode for curl/agents
• GET /login / GET /logout - browser login/logout flow
• GET /oauth/authorize / POST /oauth/token - OAuth provider flow for programmatic clients
• POST /settings/tokens - create a long-lived token
• POST /settings/tokens/:id/revoke - revoke a long-lived token

Everything else is forwarded to ripgit.

Set these in cloudflare.config.ts or as Worker secrets:

• GITHUB_CLIENT_ID - GitHub OAuth App client ID (bindings.text(...))
• GITHUB_CLIENT_SECRET - GitHub OAuth App client secret (cf workers secrets update GITHUB_CLIENT_SECRET --worker ripgit-auth)
• SESSION_SECRET - random 32+ character secret for signing browser sessions (cf workers secrets update SESSION_SECRET --worker ripgit-auth)
• OAUTH_KV - KV namespace used for OAuth state, issued tokens, and token indexes
• RIPGIT - Service Binding that points at the main ripgit Worker

workers-oauth-provider also injects the OAUTH_PROVIDER helper at runtime.

Create a GitHub OAuth App at https://github.com/settings/applications/new.

• Homepage URL: your deployed auth worker URL, for example https://git-auth.example.workers.dev
• Authorization callback URL: https://git-auth.example.workers.dev/oauth/callback
• Local dev callback URL: http://localhost:8787/oauth/callback

From the repo root:

cd examples/github-oauth
npm install
npm run dev:full

That runs two cf dev servers that find each other through Wrangler's local dev registry, so the RIPGIT Service Binding declared in cloudflare.config.ts resolves:

• the auth worker on http://localhost:8787
• the main ripgit Worker on http://localhost:8788

Then:

1. Visit http://localhost:8787
2. Sign in with GitHub
3. Open http://localhost:8787/settings
4. Generate a token
5. Push a repo with that token

Example push:

git remote add origin http://USERNAME:TOKEN@localhost:8787/USERNAME/my-project
git push origin main

Create the KV namespace and fill the ID into examples/github-oauth/cloudflare.config.ts:

cf kv namespaces create --title OAUTH_KV

Set the secrets:

cf workers secrets update GITHUB_CLIENT_SECRET --worker ripgit-auth
cf workers secrets update SESSION_SECRET --worker ripgit-auth

Deploy ripgit first, then the auth worker:

cf deploy
cd examples/github-oauth
cf deploy

Make sure the RIPGIT binding in examples/github-oauth/cloudflare.config.ts points at the deployed ripgit Worker name.

After deployment, update the GitHub OAuth App callback URL to your deployed auth worker URL.

The auth worker landing page and /settings support the same text-mode negotiation as ripgit repo pages:

curl -H 'Accept: text/markdown' https://your-auth-worker.example/
curl -H 'Accept: text/plain' https://your-auth-worker.example/settings
curl 'https://your-auth-worker.example/settings?format=md'

• Accept: text/markdown returns markdown
• Accept: text/plain returns plain text
• ?format=md and ?format=text work when you can't keep headers attached while following links

The text pages explain what the auth worker does, which paths are available, and which POST actions require an authenticated session.