diff --git a/packages/auth/src/index.js b/packages/auth/src/index.js
index 84e3fe6595..51431e4241 100644
--- a/packages/auth/src/index.js
+++ b/packages/auth/src/index.js
@@ -8,6 +8,7 @@ const { jwt, local, google } = require("./middleware")
 const { Cookies, UserStatus } = require("./constants")
 const { hash, compare } = require("./hashing")
 const { getAppId, setCookie } = require("./utils")
+const { generateUserID, getUserParams } = require("./db/utils")
 
 // Strategies
 passport.use(new LocalStrategy(local.options, local.authenticate))
@@ -32,6 +33,9 @@ module.exports = {
   passport,
   Cookies,
   UserStatus,
+  StaticDatabases,
+  generateUserID,
+  getUserParams,
   hash,
   compare,
   getAppId,
diff --git a/packages/worker/src/api/controllers/admin/index.js b/packages/worker/src/api/controllers/admin/index.js
index b6531174bd..515feb8420 100644
--- a/packages/worker/src/api/controllers/admin/index.js
+++ b/packages/worker/src/api/controllers/admin/index.js
@@ -1,10 +1,10 @@
 const CouchDB = require("../../../db")
 const {
-  StaticDatabases,
+  hash,
   generateUserID,
   getUserParams,
-} = require("../../../db/utils")
-const { hash } = require("../../../utils")
+  StaticDatabases,
+} = require("@budibase/auth")
 const { UserStatus } = require("../../../constants")
 
 const USER_DB = StaticDatabases.USER.name
diff --git a/packages/worker/src/utils.js b/packages/worker/src/utils.js
deleted file mode 100644
index 260a64cda5..0000000000
--- a/packages/worker/src/utils.js
+++ /dev/null
@@ -1,80 +0,0 @@
-const env = require("./environment")
-const { DocumentTypes, SEPARATOR } = require("./db/utils")
-
-const APP_PREFIX = DocumentTypes.APP + SEPARATOR
-
-function confirmAppId(possibleAppId) {
-  return possibleAppId && possibleAppId.startsWith(APP_PREFIX)
-    ? possibleAppId
-    : undefined
-}
-
-/**
- * Given a request tries to find the appId, which can be located in various places
- * @param {object} ctx The main request body to look through.
- * @returns {string|undefined} If an appId was found it will be returned.
- */
-exports.getAppId = ctx => {
-  const options = [ctx.headers["x-budibase-app-id"], ctx.params.appId]
-  if (ctx.subdomains) {
-    options.push(ctx.subdomains[1])
-  }
-  let appId
-  for (let option of options) {
-    appId = confirmAppId(option)
-    if (appId) {
-      break
-    }
-  }
-
-  // look in body if can't find it in subdomain
-  if (!appId && ctx.request.body && ctx.request.body.appId) {
-    appId = confirmAppId(ctx.request.body.appId)
-  }
-  let appPath =
-    ctx.request.headers.referrer ||
-    ctx.path.split("/").filter(subPath => subPath.startsWith(APP_PREFIX))
-  if (!appId && appPath.length !== 0) {
-    appId = confirmAppId(appPath[0])
-  }
-  return appId
-}
-
-/**
- * Store a cookie for the request, has a hardcoded expiry.
- * @param {object} ctx The request which is to be manipulated.
- * @param {string} name The name of the cookie to set.
- * @param {string|object} value The value of cookie which will be set.
- */
-exports.setCookie = (ctx, value, name = "builder") => {
-  const expires = new Date()
-  expires.setDate(expires.getDate() + 1)
-
-  if (!value) {
-    ctx.cookies.set(name)
-  } else {
-    ctx.cookies.set(name, value, {
-      expires,
-      path: "/",
-      httpOnly: false,
-      overwrite: true,
-    })
-  }
-}
-
-/**
- * Utility function, simply calls setCookie with an empty string for value
- */
-exports.clearCookie = (ctx, name) => {
-  exports.setCookie(ctx, "", name)
-}
-
-/**
- * Checks if the API call being made (based on the provided ctx object) is from the client. If
- * the call is not from a client app then it is from the builder.
- * @param {object} ctx The koa context object to be tested.
- * @return {boolean} returns true if the call is from the client lib (a built app rather than the builder).
- */
-exports.isClient = ctx => {
-  return ctx.headers["x-budibase-type"] === "client"
-}