I have been working on a lightweight authentication flow designed for SaaS apps, courses, and small platforms that do not want to deal with complex identity systems or collect personal data.

Toqen provides QR-based login, temporary access passes, and TOTP verification without storing user information. The goal is to create a simple, privacy-first alternative to email login and passwords.

It uses Cloudflare Turnstile for anti-bot protection and runs on an edge-first stack. I would appreciate feedback from the community on the architecture, security considerations, and potential pitfalls.

Demo: https://www.toqen.app/demo