Cloudflare's Kenton Varda prompts an OAuth 2.1 provider library out of Claude Code in about five days
Kenton Varda, lead engineer on Cloudflare Workers and a self-described AI skeptic, built the workers-oauth-provider library mostly with Claude Code and kept the prompts in the commit history. He says every line was reviewed and cross-checked against the RFCs by security experts. He estimates writing it by hand would have taken 2–5x longer.
The numbers (as reported)
| Time with AI | ~5 days of heavy work (with other duties), plus minor commits over the month |
|---|---|
| Library size | ~5,000 lines incl. comments, tests and docs |
| Author's by-hand estimate | 2–5x longer ("a few weeks, maybe months") |
Facts
- Company / subject
- Cloudflare
- Tools
- Claude Code
- Codebase
- greenfield
- Work type
- New library
- Stack
- TypeScript, Cloudflare Workers, OAuth 2.1
- Published
- 2025-06-03
- Last checked
- 2026-10-18
Caveats
The author calls it a near-ideal case: a well-known standard on a well-known platform with a clear spec. He says AI hasn't saved him much time on the Workers runtime itself. Two vulnerabilities (CVE-2025-4143, missing redirect_uri check; CVE-2025-4144, PKCE bypass) were fixed in v0.0.5 in May 2025. The advisories don't say whether the AI or a human introduced them. The time saving is the author's own guess.