Technology · Platform

Cloudflare Workers

An edge worker exposes a trimmed, authenticated tool surface to a vendor's agent platform without opening the estate behind it.

Auth and access plane · FAFOHiveEdge authenticationSigned event intake
Only real tool calls get past the edge
vendor platformsWorkerprivate estate
Discovery probesanswered at the edge
Trivial JSON-RPCanswered at the edge
Wrong tenantrefused
Tool callsforwarded with a backend bearer
the connector never holds the estate's credential
  • ~300lines of JavaScript in the Copilot Studio Worker
  • 2key slots, so credentials rotate without an outage
  • 300 sreplay window on signed events
  • 5 minbetween edge sweeps for events past their service window

A trimmed surface for Copilot Studio

Auth and access plane lets Microsoft Copilot Studio call tools in my private estate, and its connector behaves in ways its documentation does not describe.

I put a Cloudflare Worker in front of the estate as the connector's only public surface. The edge runtime has none of the usual crypto libraries, so tokens are verified with WebCrypto against signing keys cached in KV.

Two key slots across a rotation · illustrative
Slot A, old key
removed
Slot B, new key
both valid
The key is compared by value in constant time, so it survived Microsoft renaming the query parameter that carries it. Entra tokens for my tenant and app are the other way in.

The edge logs showed what Copilot Studio actually sends: unauthenticated discovery probes, renamed parameters, and response caching on Microsoft's API hub.

I shape integrations from how a vendor's client behaves in practice.

Verifying signed events at the edge

FAFOHive sends signed social-platform events to agents, and delivery over the internet repeats and reorders. I ended the event plane at an edge listener built on a Worker with D1 and KV; an exact-body HMAC with a replay window makes at-least-once delivery safe to deduplicate.

Deliveries · repeated and reordered
ABACBA

each signed with a timestamped HMAC over the exact body

Stored · one per event ID
ABC

a 200 means stored, whether the delivery was new or a duplicate

An edge cron raises a breach event for anything still unhandled past its service window.

It also serves a signed cross-provider pull feed. Senders retry only on network or 5xx failures, on a fixed schedule, and every attempt is persisted. Events may be redelivered any number of times; social actions are never repeated.