Hono, Workers and Bun

Protect routes

lathHono puts the verified user on the context under lath. Token verification uses jose, which is WebCrypto — no Node built-in, so this works unchanged on every edge runtime.

import { Hono } from "hono";
import { lathHono } from "@trylath/sdk";

const app = new Hono();
app.use("/api/*", lathHono({ environmentId: Bun.env.LATH_ENV_ID! }));

app.get("/api/me", (c) => c.json(c.get("lath")));

The one Node dependency

verifyWebhook imports node:crypto for its HMAC and its constant-time compare. Everything else in the SDK — the client, verifyAccessToken, the middleware — is fetch and jose.So on Cloudflare Workers a webhook route needs nodejs_compat; Deno and Bun provide node:crypto already. If you would rather not enable it, the webhooks guide has a dependency-free verification you can paste, and WebCrypto’s crypto.subtle covers the same ground.

# wrangler.toml
compatibility_flags = ["nodejs_compat"]

Keys in a Worker

A Worker has no process.env. Bind the secret and read it off the environment argument, so the key is never inlined into the script.

import { createLath } from "@trylath/sdk";

export default {
  async fetch(req: Request, env: { LATH_API_KEY: string }) {
    const lath = createLath({ key: env.LATH_API_KEY });
    await lath.email.send({ to: "you@example.com", subject: "Hi", text: "From the edge." });
    return new Response("sent");
  },
};

Last modified on September 13, 2026

Overview

Get started

Frameworks

Sending

Platform

Surfaces

Hono, Workers and Bun