OAuth2 Proxy
A reverse proxy that adds Google, Microsoft, GitHub or OIDC login in front of your web apps.
- Stars
- 15.3k
- Forks
- 2.3k
- Licence
- MIT
- Language
- Go
- Last update
- 5 days ago
- Type
- Other
What it is
OAuth2 Proxy sits in front of a web application and makes visitors sign in with an identity provider such as Google, Microsoft Entra ID, GitHub, or a generic OpenID Connect service before they can reach it. It can run as a standalone reverse proxy or as middleware inside an existing proxy or load balancer setup. It can also forward user details such as usernames and groups to the app as HTTP headers.
- Put a single sign-on login page in front of an internal dashboard
- Pass a user's preferred username or group membership to an upstream app as HTTP headers
- Add OAuth2 or OIDC authentication to several applications behind one load balancer
Great for
- Teams protecting internal web apps that have no login system of their own
- Operators who already run a reverse proxy or load balancer and want to add single sign-on
- Setups that need login with a provider like Google, Microsoft Entra ID, or GitHub
- Projects that need an MIT-licensed, self-hosted component
Not ideal for
- People who want a hosted login service with no servers to run; this is software you deploy and maintain yourself
- Apps that need fine-grained authorization logic inside the app itself, since the README only describes authentication and passing user details along
How to get it
- 1
Download the app
You'll need: An identity provider account and OAuth2 or OIDC client credentials
Clone the repository
git clone https://github.com/oauth2-proxy/oauth2-proxy - 2
Run it
- Read the Installation Docs at https://oauth2-proxy.github.io/oauth2-proxy/installation
- Download a binary for your platform from the latest release on GitHub, or pull an image
- Configure your identity provider and the proxy settings described in the docs
- Start the proxy and point your reverse proxy or load balancer at it
- 3
Get the most out of it
- Use the example setup files in contrib/local-environment to test a configuration before deploying
- Choose the provider-specific implementation when you need user groups or preferred usernames
- Use the Alpine-suffixed images if you need a shell for debugging, as the README notes
- Pin a released version rather than the nightly images for production
Downloads
Strengths
- Supports many identity providers, including a generic OIDC option and specific ones for Google, Microsoft Entra ID, and GitHub
- Can run standalone or as middleware in existing proxy and load balancer setups
- Released under the MIT license and has a large star count and an active release history
Trade-offs
- The README says review times can vary and that the project is volunteer-driven, so changes may take a while to merge
- Nightly images are unstable and the README says not to use them in production without knowing what you are doing
- Older versions before v6.0.0 have a known open redirect vulnerability, so you should run a current release
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| oauth2-proxy (this) | 15.3k | Other | intermediate | 5 days ago | Teams protecting internal web apps that have no login system of their own |
| better-auth | 30.6k | Library | intermediate | 5 days ago | TypeScript developers who need login and access control in their own app |
| hackathon-starter | 35.3k | Library | intermediate | 7 days ago | Developers starting a hackathon project who want a working login system quickly |
| echo | 32.8k | Library | intermediate | 7 days ago | Go developers building REST APIs or backend services |
| nginxconfig.io | 28.3k | App | beginner | 1.9 years ago | People setting up an NGINX server for a website or app who want a starting config |
| passport | 23.5k | Library | intermediate | 2.2 years ago | Node.js and Express developers who need to add login to an existing app |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.