An admin panel on Workers KV and Zero Trust

A salon owner needed to change her opening hours without calling me. That is the entire brief, and it is a more interesting constraint than it sounds.

What I did not build

The obvious answer is a CMS. Prismic or Sanity would have worked — I use Prismic daily at work. But for one client editing about fifteen fields, a hosted CMS means a monthly bill, an account she has to remember, and an interface with ninety percent of its surface irrelevant to her.

A database was worse. Nothing here justifies a Postgres instance and the ongoing cost of keeping it alive.

What the site actually needs

Two things:

• A JSON blob the site reads at build and request time
• A form that writes that blob

That is a key-value store and a form. Cloudflare Workers KV is a key-value store with a generous free tier, sitting on the same platform already serving the site.

The gate

The interesting part is authentication, because I wrote none.

Cloudflare Access sits in front of the /admin route and handles it entirely: she gets an email with a one-time code, and the Worker behind it only ever sees requests that already passed. No password hashing, no session table, no reset flow, no leaked-credential surface.

/          → public site, cached at the edge
/admin     → Cloudflare Access → the editor
/api/hours → Worker, reads and writes KV

Delegating auth to the platform removed the single largest source of bugs and liability from a small project. There is nothing to breach because there is nothing stored.

What I would change

Optimistic UI on the editor form. Right now saving waits for the round trip, and on a slow phone connection that pause reads as nothing happened, which prompts a second click. Not a bug, but it feels like one, and how something feels is the job.