OAuth2 Proxy

Use it when

• An internal dashboard or self-hosted tool has no login page and you need to put SSO in front of it without modifying the application code
• Multiple web applications behind one reverse proxy or load balancer all need OAuth2/OIDC authentication handled in one place, with user and group details forwarded as headers

What it solves

Not the fit when

• Application-internal authorization decisions beyond the authentication gate; the upstream application still must enforce its own permissions.
• Deployments where users can bypass the proxy and reach the upstream directly.
• Trusting forwarded identity headers from untrusted clients; strip spoofable incoming headers and accept identity only from the proxy boundary.
• Production without reviewed TLS, cookie, redirect, provider, and proxy-header configuration.
• Versions older than v6.0.0 covered by the repository security notice; use a current supported release.
• Nightly container images, which the project marks as unstable for production.
• headless oauth token acquisition for scripts
• in-app user database and signup flows
• fine-grained per-resource authorization logic
• api key issuance and management

Install

Download a prebuilt oauth2-proxy binary from the GitHub releases page (all major architectures) or pull the container image quay.io/oauth2-proxy/oauth2-proxy

Invoke

Run the oauth2-proxy binary as a standalone reverse proxy or as middleware in an existing reverse proxy or load balancer setup, configured against an OAuth2/OIDC provider (Google, Microsoft Entra ID, GitHub, login.gov, or generic OIDC); it intercepts requests, redirects users to the provider for login, and can forward username and group details as HTTP headers to the upstream app. Setup is covered in the project installation docs and contrib/local-environment example files.

Alternatives

No reviewed alternatives recorded yet.