Architecting Low-Latency Global Edge Portals with Cloudflare Workers, Better-Auth, and D1 SQLite

What is an Edge-First Client Portal Architecture?

An edge-first client portal architecture runs authentication, session validation, database querying, and static asset delivery across hundreds of distributed data centers worldwide instead of routing every request to a centralized origin server. By pairing Cloudflare Workers V8 isolates with D1 SQLite read replication and lightweight authentication protocols like Better-Auth, global users experience Time to First Byte (TTFB) latencies under 25 milliseconds regardless of geographic location.

Traditional Centralized Origin (Virginia us-east-1):
[User in Frankfurt / Tokyo / Sydney] ──(220ms RTT)──► [Origin Server] ──► [PostgreSQL]

Edge-First Cloudflare Workers + D1 Architecture:
[User in Tokyo] ──(12ms RTT)──► [Cloudflare Tokyo PoP]
                                        │
                                        ├──► [Workers V8 Isolate (0ms cold start)]
                                        ├──► [Better-Auth Session Verification]
                                        └──► [D1 SQLite Edge Replica Read]

When building high-traffic client portals for venture-backed B2B startups, international latency is often the silent killer of user experience. If a founder in London or Singapore logs into their dashboard and waits 800 milliseconds for every milestone tab switch, the product feels sluggish.

Here is the exact architecture we deployed for the Stainless Studio client portal to achieve sub-25ms global response times with zero maintenance overhead.

The Stack: Why Cloudflare Workers, D1, and Better-Auth?

Three specific engineering requirements dictated our stack choices:

1. Zero Cold Starts: Traditional serverless lambdas on AWS or Google Cloud suffer from 300ms to 1.5s cold starts when spinning up container environments. Cloudflare Workers run on V8 isolates, starting execution in under 5 milliseconds.
2. Embedded SQL at the Edge: Cloudflare D1 provides serverless SQLite databases with automatic read replication across global points of presence (PoPs).
3. Framework-Agnostic Authentication: Better-Auth runs directly inside edge worker runtimes without requiring heavy Node.js standard library polyfills.

Global Latency Benchmarks (TTFB for Authenticated Dashboard Query)

Configuring Better-Auth on Cloudflare Workers

Better-Auth provides clean TypeScript type safety and built-in SQLite support. Here is our edge worker entry point handling session verification and route dispatching:

import { betterAuth } from "better-auth";
import { d1Adapter } from "better-auth/adapters/d1";

export function createAuthInstance(env: { DB: D1Database; BETTER_AUTH_SECRET: string; APP_URL: string }) {
  return betterAuth({
    database: d1Adapter(env.DB, {
      provider: "sqlite",
    }),
    secret: env.BETTER_AUTH_SECRET,
    baseURL: env.APP_URL,
    session: {
      cookieCache: {
        enabled: true,
        maxAge: 5 * 60, // 5-minute cryptographic edge cookie cache
      },
    },
  });
}

import { createAuthInstance } from "./auth";
import { Kysely } from "kysely";
import { D1Dialect } from "kysely-d1";
import type { DatabaseSchema } from "./schema";

export default {
  async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
    const url = new URL(request.url);
    const auth = createAuthInstance(env);

    // 1. Delegate auth endpoints directly to Better-Auth handler
    if (url.pathname.startsWith("/api/auth")) {
      return auth.handler(request);
    }

    // 2. Fast edge session lookup via encrypted cookie cache
    const session = await auth.api.getSession({ headers: request.headers });
    if (!session && url.pathname.startsWith("/api/portal")) {
      return new Response(JSON.stringify({ error: "Unauthorized" }), {
        status: 401,
        headers: { "Content-Type": "application/json" },
      });
    }

    // 3. Execute type-safe edge query with Kysely on D1
    const db = new Kysely<DatabaseSchema>({
      dialect: new D1Dialect({ database: env.DB }),
    });

    if (url.pathname === "/api/portal/milestones") {
      const milestones = await db
        .selectFrom("studio_milestones")
        .selectAll()
        .where("team_id", "=", session!.user.id)
        .orderBy("created_at", "desc")
        .execute();

      return new Response(JSON.stringify({ success: true, data: milestones }), {
        headers: {
          "Content-Type": "application/json",
          "Cache-Control": "private, no-cache",
        },
      });
    }

    return new Response("Not Found", { status: 404 });
  },
};

Edge Database Migrations and Prepared Statements

Because SQLite runs at the edge, transactions that require multiple roundtrips to an external database are eliminated. However, you must write idempotent migrations and avoid unbounded table scans.

We keep our D1 migrations versioned in SQL files and apply them through wrangler d1 migrations apply:

-- migrations/0001_init_portal_schema.sql
CREATE TABLE IF NOT EXISTS studio_milestones (
  id TEXT PRIMARY KEY,
  team_id TEXT NOT NULL,
  title TEXT NOT NULL,
  status TEXT CHECK(status IN ('backlog', 'in_progress', 'ready_for_review', 'deployed')) NOT NULL DEFAULT 'backlog',
  pr_url TEXT,
  preview_url TEXT,
  allocated_hours REAL NOT NULL DEFAULT 0.0,
  created_at TEXT NOT NULL DEFAULT (datetime('now')),
  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
);

CREATE INDEX IF NOT EXISTS idx_milestones_team ON studio_milestones(team_id);

Three Hard Rules for Edge Backend Development

1. Avoid Heavy Node Polyfills: Stick to Web Standard APIs (fetch, Request, Response, Web Crypto, ReadableStream). If a package relies on fs or native C++ addons, it will fail in V8 isolate environments.
2. Cache Session Verification in Cookies: Validating session tokens against the database on every micro-request adds unnecessary CPU time. Enable cryptographic cookie caching with a 5-minute TTL.
3. Use Prepared Statements for SQL: Always parameterize your SQL queries with Kysely or D1’s native prepared statements to benefit from SQLite’s compiled query cache.