# Vouch Proxy

> MIT SSO for Nginx via auth_request and OAuth/OIDC

**Category:** DevOps  
**Pricing:** open-source  
**URL:** https://github.com/vouch/vouch-proxy  
**GitHub:** https://github.com/vouch/vouch-proxy  
**Added:** 2026-10-18

---

## The Hook

Vouch Proxy adds single sign-on to any site behind Nginx using the auth_request module: Nginx asks Vouch whether a request is logged in, and Vouch sends users through Google, GitHub, Okta, Keycloak or another OIDC provider.

## What's Good

MIT (vouch/vouch-proxy), developed since 2017 in Go. One Vouch instance can protect all your sites at once, and the README says validation responses take under 1 ms when it runs next to Nginx. Supports Google, GitHub, Azure AD, Okta, Slack, ADFS, AWS Cognito, Gitea, Nextcloud, Pocket ID and most OIDC providers. ★~3.3k.

## The Catch

Nginx only (via auth_request); for Traefik or Caddy, other forward-auth tools fit better. It authenticates but offers only basic authorization by domain, user or team. Tagged releases are infrequent, so follow main or the Docker images.

## Verdict

The simplest way to put SSO in front of internal Nginx sites.