OpenWorkspace

Open source · Self-hosted · Cloudflare-native

Your team’s workspace, running on your Cloudflare account.

OpenWorkspace is an open-source workspace for teams. It starts with team mail, passkey sign-in and single sign-on — and deploys to Workers, D1, Durable Objects and R2 that you own.

bun create @open-workspace
View on GitHub

License
Apache-2.0
Sign-in
Passkeys only
Pricing
No per-seat fees
First module
Team mail

01 — Ownership

Everything lives on your Cloudflare account.

There is no OpenWorkspace cloud. You deploy the workspace into your own account, and every message, attachment and identity record stays in storage you control.

  • Your data. Mail sits in your D1 database and R2 bucket. There is no hosted backend, and AI providers are strictly opt-in.
  • No per-seat pricing. Add the whole company. You pay Cloudflare for what the workspace uses — not a fee per person.
  • Predictable costs. It runs on the Workers Paid plan (from $5/month per account, not per user). Usage beyond the included amounts is billed by Cloudflare at its standard rates.
Runs on
  • Workersapp & API
  • D1database
  • Durable Objectsrealtime
  • R2attachments
  • Queuesbackground jobs
  • Email Servicesend & receive
  • ContainersOffice → PDF

02 — Features

Team mail today, with identity built in.

MailInboxes that teams share

  • Personal and shared inboxes across multiple domains
  • Delivery status for bounces, deferrals and complaints
  • Previews for PDF, images and Office files, converted to PDF
  • Realtime updates and PWA push notifications

Identity & SSOOne login for your other apps

  • Passkey-only sign-in — no passwords to leak
  • OIDC and SAML identity provider with groups and roles claims
  • SCIM 2.0 provisioning and back-channel logout
  • Invitations and recovery via one-time links

AdminTeams, roles and lists

  • Teams as shared mailboxes or mailing lists
  • An Everyone team keeps all@ current
  • Custom roles that can delegate parts of administration
  • Teams feed SSO group claims automatically

SafetyKnow who really sent it

  • SPF, DKIM and DMARC sender authentication
  • Spamhaus reputation checks on incoming mail
  • Phishing reports from your team

AIClassify and translate, your provider

  • Spam and folder classification for incoming mail
  • Message translation, and PDF translation in place
  • Workers AI / AI Gateway, OpenAI, Anthropic, Google or any OpenAI-compatible API
  • Keys kept in Worker secrets

DevelopersBuilt to be extended

  • Signed webhooks for mail and admin events
  • MCP server with OAuth for AI agents
  • JMAP for mail clients, signed in with OAuth
  • Modular: mail ships as @open-workspace/email
  • Configured in TypeScript, deployed with Alchemy

03 — How it works

Three small files. One deploy.

bun create @open-workspace scaffolds a tiny project. The workspace itself comes from npm, so updates are a version bump.

  1. 1

    Describe your workspace

    src/worker.ts
    import { createWorkspace } from "@open-workspace/core";
import { email } from "@open-workspace/email";

export { MailboxDO, OfficePreviewContainer } from "@open-workspace/email";

export default createWorkspace({
  domains: ["example.com"],
  modules: [email()],
});
  2. 2

    Declare the infrastructure

    alchemy.run.ts
    import { OpenWorkspace } from "@open-workspace/core/alchemy";
import { Email } from "@open-workspace/email/alchemy";

export default Alchemy.Stack("Workspace", { providers, state },
  OpenWorkspace({
    name: "acme-workspace",
    main: "./src/worker.ts",
    domain: "mail.example.com",
    modules: [Email({ domains: ["example.com"] })],
  }));
  3. 3

    Deploy to Cloudflare

    terminal
    $ bun run deploy
  D1, R2, Queues, Durable Objects…
✓ https://mail.example.com

04 — Roadmap

Mail is the first module. Git is next.

OpenWorkspace is built as modules on a shared core — people, teams, roles and SSO. More modules are coming, starting with git hosting.

  • @open-workspace/emailAvailable
  • gitComing
  • …and morePlanned