| Runtime | Cloudflare Workers | Serves the sign-in pages and the OIDC endpoints. Custom domain only; workers.dev and preview URLs are off. |
| State | Durable Objects (SQLite) | One instance per email for codes (hash only, 10 minutes), and one per sign-in or authorization code. Cleared by alarm. |
| Rate limits | Workers Rate Limiting binding | Per IP and per email on code sends, code checks, /authorize, and /token. |
| Email | Cloudflare Email Sending | send_email binding. From login@macrostrategies.ai with SPF, DKIM, and DMARC on the domain. |
| Access control | Cloudflare Access | Uses this service as a generic OIDC login method. Access checks its own policies and issues the session cookie. |
| Logs | Workers Logs | Structured JSON events. No codes, tokens, secrets, or full email addresses. |