The source.
MIT-licensed Nathan code, built on Better Auth. Read it. Fork it. Ask an agent to explain a suspicious line. It should be able to answer without scheduling a founder interview.
OPEN THE REPOSITORYNATHAN / AN INDEPENDENT OPEN-SOURCE PROJECT
YOU CANSEEEVERYTHING.
Committed to the truth.
This has caused difficulties for the pitch deck.
Independent, MIT-licensed auth you run in your own Cloudflare account. Read the Nathan source. Inspect the cost model. Review your agents’ changes. You control the installation, identities and keys.
Not affiliated with or endorsed by Cloudflare. Pre-beta.
Keep credentials and user data private. Transparency has a scope.
SHOW YOUR WORK
THE DECK CAN WAIT
THE DECK CAN WAIT
EXHIBIT A / THE ARITHMETICMODEL, NOT INVOICE
THE MASCOT HAS NOT VERIFIED THE PROTOCOL.
APP + NATHAN / MONTH*
$1,278.57
Same app + Clerk Pro$17,911.65
Monthly retained users1,000,000
*Modeled CRUD app + auth. October 2026 list rates. Labor extra. One million users is a projection, not tested capacity.
INSPECT THE CALCULATION.The spreadsheet is public.
It has not signed an NDA.PLEASE READ THE ASSUMPTIONS BEFORE THE HEADLINE.
SOURCE AVAILABLE.COSTS ITEMIZED.DIFFS REVIEWABLE.TRUTH IN SCOPE.
01 / THE TRUTH HAS SUPPORTING DOCUMENTS
The truth.
With file paths.
A convincing explanation is pleasant. An inspectable implementation is more useful. Here is the part where the presentation is asked to produce the thing it is talking about.
The numbers.
Published prices. Explicit workloads. A model you can rerun. Every projected dollar has a calculation behind it. The calculation is allowed to make the pitch less impressive.
FOLLOW THE CALCULATIONThe unfinished work.
Nathan is pre-beta. Live protocol, installation and security gates remain open. The roadmap still contains work because removing it from the slide did not complete it.
INSPECT THE RELEASE GATES02 / THE AUTH DEPARTMENT / WORKERS + D1
Your auth. Your account.
Cloudflare runs the compute.
Workers run the identity provider. D1 holds identity and session data. Better Auth provides the foundation. It all runs in your Cloudflare account. There is no separate Nathan-hosted auth service to rent.
EXECUTION / CLOUDFLARE WORKERS
Run the auth.
The IdP runs in your account. Workers charges for requests and active CPU. Waiting around does not become a billable personality trait.
Read the Workers ratesSTORAGE / CLOUDFLARE D1
Keep the identities.
Users, sessions and policy state live in D1. Database work and storage are metered. The mere existence of a user is not a Nathan license event.
D1 has limits. Read them.CONTROL / YOUR CLOUDFLARE ACCOUNT
Keep the keys.
Your account. Full source. Your agents. Inspect the code and the bill. If Nathan disappoints you, the fork button is already the escalation process.
NO NATHAN PER-USER LICENSE FEE.Cloudflare still sets its prices and limits. Please do not list it as a subsidiary.
03 / CLERK’S PRICING HAS ENTERED THE SPREADSHEET
Clerk’s pricing is public.
So is the multiplication.
Clerk Pro bills by monthly retained users. Cloudflare bills for resource usage. Below: published rates and one illustrative CRUD workload. The calculator is allowed to disagree with the sales pitch.
THE FINANCIAL FORECASTILLUSTRATIVE WORKLOAD · USD / MONTH
Same application in both stacks: $686.65/month before authentication.
APP + CLERK PRO
$17,911.65
per month, at published monthly rates
Common app$686.65
Authentication$17,225.00
Your users came back. Someone has monetized the reunion.
APP + NATHAN YOUR ACCOUNT
$1,278.57
per month, under the modeled workload
Common app$686.65
Incremental auth + email$591.92
The invoice does not include your time. The plan does.
$16,633.08less modeled cash spend per month, before incremental labor.
1,000 API requests/person/month; 90% indexed reads; 100 kB stored app data/person; one Nathan policy check/API request. The app and Nathan share one set of Cloudflare allowances.
Every account is assumed active and monthly retained here. Auth assumes 4 sign-ins, 20 refreshes and 0.2 lifecycle emails/person/month. Auth shares allocate app costs first. Prices checked 28 Oct 2026; workloads are estimates. 1M+ capacity is untested. Frequent refreshes can erase the savings. Operator time, development and unspecified services are extra.
Public rates: Clerk · Workers · D1 · Resend. Clerk uses monthly retained users, not all stored accounts. Managed support and equivalent operational guarantees require their own evaluation.
An inconvenient disclosure: Low usage or heavy refresh activity can favor Clerk. Those cases are in the report. The sales presentation has classified them as plot twists.
04 / CONFIDENCE HAS BEEN REMOVED FROM THE ACCEPTANCE CRITERIA
The agent said it works.
Show the diff.
Your agents can read the actual source, propose changes, and explain the result. You can inspect their work in your own checkout. A reassuring paragraph is very inexpensive to generate.
Ask for the change, the checks, and the remaining risks. A second agent may review the first. A human remains responsible for security decisions, upgrades, recovery and incident response.
Read the agent operating rulesTRUTH_REVIEW.txt
# Proposed division of responsibilities
01 Agent: read the source and rules.
02 Agent: propose a small change.
03 Human: review what actually changed.
04 Both: verify it in staging.
05 Agent: explain the remaining risks.
06 Human: decide what goes live.
# On the subject of ownership:
git clone --branch feat/bootstrap-blueprint \
https://github.com/gmackie/nathan
> Confidence is not a test result.A second agent is welcome to review the first agent. This still does not replace an independent security audit.
The actual instructions, in case the button becomes a project
Work on Nathan, the independent open-source authentication blueprint that runs in the operator’s Cloudflare account, at https://github.com/gmackie/nathan/tree/feat/bootstrap-blueprint. Read README.md and AGENTS.md first. Work in an isolated branch, explain your plan, and make reviewable changes. Never expose credentials or tokens. Preserve exact redirects, PKCE, verified MFA evidence, explicit application grants and private upstream isolation. Test real authentication journeys in staging and report evidence and remaining limits. Nathan is pre-beta; green unit tests alone do not establish production readiness. Human operators own security decisions and deployment approval.
05 / THE NAMING PROCESS WAS COMPLETED
How the name
was obtained.
The reasoning is documented below. Each step follows from the previous step if you are willing to continue. By the end, the software had a name.
Renaming it would require revisiting the process.
06 / QUESTIONS THAT SURVIVED THE PRESENTATION
There are still
some practical matters.
What does “see everything” actually include?
The Nathan source, published price inputs, workload assumptions, cost calculations and the changes your agents propose. Credentials, signing keys and personal data should remain private. Cloudflare’s underlying platform is still Cloudflare’s; this promise covers Nathan’s code and operating model. Open source makes inspection possible. It does not establish security or production readiness by itself.
Is this ready, or does the website just look ready?
The website is ahead of the evidence. Nathan is pre-beta. Initial Worker, gateway, CLI, Studio and SDK implementations exist, but complete live protocol, installation and security acceptance gates are still pending. Evaluate it in staging and contribute. Production support is planned after a monitored pilot. Read the roadmap.
Who is in charge when something breaks?
You. Your agents can work on the MIT-licensed source, but human operators own upgrades, backups, incident response and security decisions. You control your installation, identities, keys and Cloudflare account. Cloudflare still supplies the underlying platform, sets its prices and imposes its limits. The arrangement gives you code and operational control; it does not give you Cloudflare.
Does every app need to run on Cloudflare?
Nathan itself runs on Cloudflare. Apps hosted elsewhere are intended to connect as explicitly registered OIDC clients, with browser-guided setup in the launch scope. Grafana and a reference web app are acceptance targets alongside the protected Worker. Those live installation and protocol checks remain pending. Your login authority lives in your account; the apps can live elsewhere.
What am I supposed to be able to do at launch?
A CLI installation wizard, browser-guided external OIDC app setup, protected Workers, per-app users/groups or any-signed-in-user policies, and administrator/per-app MFA. Google, GitHub, passkeys, TOTP, email/password and enterprise OIDC are in the launch scope. These are release goals, not a claim that every end-to-end flow is verified. SAML and directory sync come later.
Does the hot dog make the infrastructure free?
The hot dog has no effect on the pricing. Nathan’s MIT-licensed code has no Nathan per-user license fee. Cloudflare infrastructure, auth email and your operating effort are real costs. At 50,000 retained users, the identity-only example and Clerk Pro both model $25/month. Low usage or frequent refreshes can favor Clerk. The full report shows those cases.
Where is the sustainable part?
In paying for work that is actually done, including maintenance. Keep the core auditable, document the operating model, share improvements upstream, and fund the maintenance you rely on. Lower infrastructure costs create room in that budget. They do not maintain the software. This blueprint promises neither free support, unlimited scale nor permanent vendor prices. Contributions to code, documentation and real-world validation all count.
THE CLAIM HAS BEEN PROVIDED WITH A LINK
Go on.
Check the work.
The truth can survive a second tab.