What sort of authentication? Are you trying to ensure that only your webapp hits your backend (which in this case is implemented in Workers)? That's generally impossible on the web, as all the code in the browser used to hit it is accessible to visitors.