![\"\"](\"/icon.png\"){kind=icon}
\n StaticLayer
Moderation console
Sign in with GitHub (password-less)
\nFree, no credit card, no Zero Trust plan. Create a GitHub OAuth App, set 4 Worker vars once, and from then on this button signs you in without a password.
\n- \n
- GitHub → Settings → Developer settings → OAuth Apps → New OAuth App. \n
- Homepage URL:
…\n - Authorization callback URL:
…\n - Set
GITHUB_CLIENT_ID,GITHUB_CLIENT_SECRET,GITHUB_ADMIN_IDS(your GitHub numeric id) on the Worker and re-deploy. \n
Full step-by-step guide: sign in with your password once → Settings → Admin access & sign-in.
\n\n StaticLayer
Moderation console
Moderation queue
\nComments awaiting approval — search, filter and moderate.
\n \n \nPublished comments
\nAlready public — unapprove or delete.
\n \n \nPages with comments
\nEvery page that received activity on this Worker — click to filter the queue.
\nAllow & block lists
\nBlocked nicknames cannot comment. Allowlisted nicknames skip the queue (and in allowlist mode only they can comment). Matched case-insensitively.
\nAllowlist
\nAuto-approved — skip moderation
\nBlocklist
\nBanned — cannot comment (ban a nickname)
\nBlocked terms (word blacklist)
\nComments containing any of these words are auto-rejected and never stored
\nSettings
\nLive settings — applied immediately, no redeploy needed. Env-var defaults are used until you override them here.
\nHigher = harder for bots (and slightly slower for visitors). Range 0–256 · default 16.
\nComma-separated. Empty disables reactions.
\nPrivate/community sites can lock comments to approved members.
\nShown as the author of your admin replies, with an \"Author\" badge on the widget.
\nAdmin access & sign-in
\nPassword-less login with GitHub OAuth is built in and free — no Cloudflare Zero Trust plan, no credit card, and no password to remember after the first setup. Create a GitHub OAuth App once, set 4 Worker vars, and the login screen shows \"Sign in with GitHub\". Your admin password stays as a fallback and is never sent to GitHub.
\nLost the admin password? Once GitHub sign-in is configured, just click \"Sign in with GitHub\". Otherwise rotate it: npx wrangler secret put ADMIN_SECRET (you choose the new value) — or reinstall fresh. Re-running the installer preserves your existing secrets (including the current password) by design.
Set up GitHub sign-in — step by step
\n- \n
- Open
github.com→ your avatar → Settings → Developer settings (bottom of the sidebar) → OAuth Apps → New OAuth App. \n - Application name: anything, e.g. \"StaticLayer admin\". \n
- Homepage URL:
…\n - Authorization callback URL:
…— this exact URL. \n - Click Register application, then copy the Client ID shown on the page. \n
- Click Generate a new client secret, then copy the Client secret (shown only once). \n
- Find your GitHub numeric user id: open
https://api.github.com/users/your-login— copy the\"id\"number (e.g.1234567). \n - Set the Worker vars:
GITHUB_CLIENT_ID= the Client ID,GITHUB_ADMIN_IDS= your numeric id (orGITHUB_ADMIN_LOGINS= your login). SetGITHUB_CLIENT_SECRETas a secret:npx wrangler secret put GITHUB_CLIENT_SECRET(or in the dashboard: your Worker → Settings → Variables → Edit → add as a secret). \n - Re-deploy (hosted installer or
npx wrangler deploy), then refresh this page: the login shows \"Sign in with GitHub\". Only accounts in your allowlist can open the console. \n
Privacy: GitHub sees only your login — the identity provider you chose. The token is used once to read your id and is then discarded, never stored. No visitor data ever leaves your Worker.
\nTelegram alerts
\nGet a private notification on Telegram when there is new activity on your site. Privacy-first: the message only says which page the activity happened on — comment text, nicknames and poll options are never sent to Telegram. Your bot token and chat id are stored only in your own private D1 database.
\nChoose which activity triggers an alert. The message includes the page link — never the content itself.
\nCreate your bot: open Telegram → search @BotFather → /newbot → choose a name and a username → copy the token it sends you.
\nFind your chat id: message your bot once (e.g. \"hi\"), then open https://api.telegram.org/bot<YOUR_TOKEN>/getUpdates in a browser and copy the number in \"chat\":{\"id\":123456789,…} (channels/groups have a leading minus).
Tip: press Save settings first, then Send test message to verify instantly. If it fails, Telegram shows the exact reason below.
\nThen press Save settings and trigger one of the enabled activities on your site (a comment, poll vote or reaction): you'll get the notification.
\nExport your data (GDPR portability)
\nDownload everything your visitors wrote — you are the data controller and can move your data anytime. Exports never include IPs, cookies or tracking data.
\nWidget builder
\nDesign your comment / reaction widget and copy the embed snippet into any page of your site.
\n\nHow it works
\nOne snippet, any page. Paste it wherever you want the widget to appear (end of the article, before the footer…).
\nIntegrating on a specific page
\n- \n
- Open the target page in your site builder and add an HTML block. \n
- Paste the snippet from the box below. \n
- Set
data-article-pathto that page's path (e.g./blog/hello-world) — or leave it empty and the widget uses the page's own URL automatically. \n - Publish. The widget auto-loads — no other setup. \n
💡 The widget talks to …. If your site is on a different domain, that domain must be in the Worker's allowed origins (set during installation) or the browser will block the requests.
Live preview
\nUpdates as you change the options above — this is exactly what your visitors will see (themes and colors apply live).
\n \n \nSnippet — copy & paste into your page
\nPolls
\nCreate StrawPoll-style polls for any page. Votes are anonymous (no IP, no cookies) and protected by proof-of-work; one vote per browser uses an anonymous in-browser token when enabled.
\nNew poll
\nLeave empty for a global poll — shown on any page where you embed it. Set it to show the poll only on that article's page.
\n- \n
- Enabling this makes the widget store a random, anonymous token in each visitor's browser (
localStorage). It is not a cookie and contains no personal data; only a hash of it is kept in your own D1 — never sent to us. \n - It is nevertheless a persistent local identifier: the widget uses it to recognise \"this browser already voted\" across visits. Under GDPR that is a form of identification, so inform visitors in your privacy policy if you use it. \n
- It does not guarantee \"one person = one vote\": a visitor can clear browser storage and vote again. It only raises the bar against casual double-voting. \n
- You remain the data controller for your site; StaticLayer never receives, stores or sees the token. \n
Live preview
\nUpdates as you type — this is what visitors see before voting.
\n \nYour polls
\n \n \nUpdates
\nCheck whether a newer StaticLayer release is available for this Worker.
\nChecking…
\n