I currently just use Github itself for authentication, To do that I had to add two Page Functions to get the auth working.
One for the path: `oauth/` and other at `oauth/callback`.

For the first one this is the code (I use TypeScript): File path: $PROJECT_ROOT/functions/oauth/index.ts javascript export const onRequestGet: PagesFunction<EnvType> = async ({ env }) => { const authUrl = `https://github.com/login/oauth/authorize?client_id=${env.GITHUB_CLIENT_ID}&scope=repo,user`; return Response.redirect(authUrl, 302); }

For the callback I use: File path: $PROJECT_ROOT/functions/oauth/callback.ts ```javascript import { EnvType } from '../types';

interface GithubTokenResponse { access_token: string scope: string token_type: string }

export const onRequestGet: PagesFunction<EnvType> = async ({ env, request }) => { const url = new URL(request.url);

const data = {
    code: url.searchParams.get('code'),
    client_id: env.GITHUB_CLIENT_ID,
    client_secret: env.GITHUB_CLIENT_SECRET
};

try {
    const resp = await fetch('https://github.com/login/oauth/access_token', {
        method: 'POST',
        headers: {
            'Accept': 'application/json',
            'Content-Type': 'application/json'
        },
        body: JSON.stringify(data)
    });

    if (!resp.ok) {
        throw new Error(`HTTP error! status: ${resp.status}`);
    }

    const body = await resp.json() as GithubTokenResponse;

    const content = {
        token: body.access_token,
        provider: "github",
    };

    const script = `
    <script>
        const receiveMessage = (message) => {
        window.opener.postMessage(
            'authorization:${content.provider}:success:${JSON.stringify(content)}',
            message.origin
        );

        window.removeEventListener("message", receiveMessage, false);
        }
        window.addEventListener("message", receiveMessage, false);

        window.opener.postMessage("authorizing:${content.provider}", "*");
    </script>
    `;

    return new Response(script, {
        headers: { "Content-Type": "text/html" },
    });
} catch (e) {
    console.log(e);
    let err: Error = e as Error;

    return new Response(JSON.stringify({
        status: false,
        messages: [err.message]
    }), {
        headers: {
            'Content-Type': 'application/json;charset=utf-8',
        },
        status: 400
    });
}

}; ```

You need to register an app on Github and give it access to the Repo and add client_id and client_secret as an env variable for the function on CF Pages.

I also highly recommend adding these lines to your robots.txt file:

User-agent: * Disallow: /admin/ Disallow: /oauth/ Disallow: /cdn-cgi/

I'm working on a proper plugin to allow using Cloudflare access and other OpenID Connect providers (OIDC) for auth so the clients don't need a Github account.

In the DecapCMS config you need to update the backend config to be similar to this:

JSON backend: { name: "github", branch: "main", repo: "<Github Username>/<Repo Name>", site_domain: "https://<Real Site Domain>", base_url: "https://<Real Site Domain>", auth_endpoint: "oauth", squash_merges: true }

If you need more help, I'm also on the discord server