# OAuth2 Proxy

> MIT CNCF Sandbox reverse-proxy auth gate vs external IdPs

**Category:** DevOps  
**Pricing:** open-source  
**URL:** https://oauth2-proxy.github.io/oauth2-proxy/  
**GitHub:** https://github.com/oauth2-proxy/oauth2-proxy  
**Added:** 2026-09-10

---

## The Hook

oauth2-proxy is the reverse-proxy auth gate in front of your apps when Authelia/Tinyauth/authentik are portals or IdPs and Dex is a federated IdP — not an app-fronting proxy.

## What's Good

MIT. CNCF Sandbox. oauth2-proxy/oauth2-proxy. Standalone reverse proxy or middleware that authenticates against *external* OAuth2/OIDC providers (Google, GitHub, Azure AD, Keycloak, …) then forwards authorized requests. Email/domain/group allowlists. Docs at oauth2-proxy.github.io/oauth2-proxy; images on quay.io/oauth2-proxy.

## The Catch

NOT an IdP and NOT a user store — it only gates apps against an upstream provider you already run or rent. Vs Authelia/Tinyauth (proxy SSO / portal), authentik (full IdP), and Dex (federated OIDC IdP that still is not an app-fronting proxy): oauth2-proxy sits in front of apps, talks out to an IdP, and never owns accounts. You still configure the upstream client, cookies/headers, and the protected upstreams.

## Verdict

MIT CNCF reverse-proxy auth gate. Free forever; bring an external IdP — this is not one.