Current compatibility and availability
Reviewed September 15, 2026. Implemented means a runtime path exists; provider, browser and environment acceptance are separate. Confirm availability in your application quickstart before enabling a feature.
Scoped email and optional name claims, separate Sandbox and Production identities, hosted routing and online session checks are implemented. Verify the exact methods and providers your application will use.
| Capability | Current position |
|---|---|
| Hosted password, optional username, passkeys, email OTP and magic links | Implemented; method policy, delivery, browser and hostname requirements apply. |
| TOTP, WebAuthn MFA and recovery codes | Implemented, including controlled replacement. Recovery does not bypass primary identity proof. |
| Google, Microsoft, Apple, GitHub | Adapters and console configuration implemented; outbound-runtime follow-up and live provider acceptance remain. |
| Enterprise SAML and OIDC | Implemented constrained protocol profiles; same provider-network acceptance boundary applies. |
| Entra ID, Google Workspace, Okta, ADFS, PingFederate | Configuration profiles, not blanket interoperability certification. Google Workspace profile is SAML. |
| AD / LDAP | External SAML/OIDC gateway integration; no direct directory bind. |
| IdP portal launch | Separate approval and fresh application-initiated code/PKCE and SSO flow; no unsolicited assertion authentication. |
| SPA / public web / native | Code + PKCE; native callbacks limited to registered HTTPS or loopback URLs. No official public SDK yet. |
| Confidential server web | Basic client authentication plus code + PKCE and rotating refresh. |
| M2M | Basic + client credentials, explicit API resource/permissions, five-minute opaque tokens. |
| Human profile and session | Scoped email/verification and optional name in ID token/UserInfo; profile-free online /oidc/session checks. |
| Environments | Separate dedicated Sandbox and Production identity stores and client registrations; ordinary private Workers today. |
| API authorization | Online permission check, human roles/organization context, and explicit service grants. Product record-level rules stay with your API. |
| Hosted Account Security | limited production rollout. Confidential server-web session handoff and sensitive-action verification are implemented; enable only when available in the selected application quickstart. See the setup guide. Wider rollout and owner-assisted acceptance remain pending. |
| Universal Login | Shared workspace theme, editor and expiring appearance-only preview. |
| Custom authentication domains | DNS/TLS onboarding and environment-aware issuer routing implemented. Domain lifecycle checks do not by themselves verify every provider sign-in on that hostname. |
| General public Management REST API / public SDK / CLI | Not a released integration contract in this baseline. Use the console and documented hosted endpoints. |
| Console API-key/webhook surfaces | Do not infer public API acceptance or signed/retried event delivery from visible controls. Such contracts are not established by these docs. |
Outside the current integration contract
Section titled “Outside the current integration contract”- SMS/voice OTP, push/Duo and adaptive/risk-based authentication.
- Direct LDAP password binding, SCIM/directory-sync acceptance and external identity-database migration as a reusable customer contract.
- Outbound SAML/WS-Federation to your application, SAML encrypted assertions, artifact/SOAP and SAML single logout.
- Device Authorization Grant, native custom-scheme callbacks, implicit and resource-owner-password grants.
- Private-key JWT, mTLS, DPoP,
client_secret_postauthentication to Oathvera, PAR/JAR and token exchange. - Agent delegation, impersonation, cross-product autonomous authority and multi-resource refresh-token extensions.
- Arbitrary OIDC claims mapping or a general profile/avatar API beyond the documented scoped fields.
- Workers for Platforms migration; dedicated identity D1s are already implemented.
The Charter describes a broader platform direction. Planned pillars and reserved paths are not today’s supported runtime. Do not add nonfunctional controls to an integration or claim compliance, tamper-evident audit export, global rate guarantees, provider certification or independent security signoff based on local tests.
Use the integration checklist to record acceptance for your application.