OAuth2 Proxy

MIT CNCF Sandbox reverse-proxy auth gate vs external IdPs

Auth / Auth · OSS/MIT · 15.2k

Reviewed 2026-09-10 · last push 2026-10-18 · repo checked 2026-10-19

What's Good

MIT. CNCF Sandbox. oauth2-proxy/oauth2-proxy. Standalone reverse proxy or middleware that authenticates against *external* OAuth2/OIDC providers (Google, GitHub, Azure AD, Keycloak, …) then forwards authorized requests. Email/domain/group allowlists. Docs at oauth2-proxy.github.io/oauth2-proxy; images on quay.io/oauth2-proxy.

The Catch

NOT an IdP and NOT a user store — it only gates apps against an upstream provider you already run or rent. Vs Authelia/Tinyauth (proxy SSO / portal), authentik (full IdP), and Dex (federated OIDC IdP that still is not an app-fronting proxy): oauth2-proxy sits in front of apps, talks out to an IdP, and never owns accounts. You still configure the upstream client, cookies/headers, and the protected upstreams.

Verdict

MIT CNCF reverse-proxy auth gate. Free forever; bring an external IdP — this is not one.

Embed

Maintainer? Add the badge to your README. It is free, links to this review, and there is no paid version.

Markdown

[![Reviewed on Stack Gems](https://stackgems.com/badge/oauth2-proxy.svg)](https://stackgems.com/gems/oauth2-proxy)

HTML

<a href="https://stackgems.com/gems/oauth2-proxy"><img src="https://stackgems.com/badge/oauth2-proxy.svg" alt="OAuth2 Proxy reviewed on Stack Gems" height="20"></a>

DevOps →

Related