ArkGravity/burrow

What is it?

Key features

• 01Shared SSO for Web and SPA applications via OIDC Authorization Code with PKCE S256.
• 02Password login with optional TOTP MFA applied to all accounts.
• 03Users, groups, custom roles and permissions with audited changes.
• 04Application portal that shows only the services a user may access.
• 05Single binary with embedded UI; PostgreSQL in production, SQLite for development.
• 06English and Simplified Chinese interface with light, dark and system themes.

Use cases

• Giving a small team one login for Grafana, Harbor and other self-hosted internal tools.
• Adding OIDC-based SSO to self-hosted services without running Redis or a message queue.
• Enforcing TOTP two-factor login for all accounts on an internal network.

Quick start

1. 1

   Download the deployment archive from Releases and extract it

   tar -xzf "burrow_${BURROW_RELEASE}_deploy.tar.gz"
2. 2

   Enter the deployment directory and create the env file

   cp .env.example .env
3. 3

   Edit .env with HTTPS issuer, secrets and database password, then start with Docker Compose

   docker compose --profile local-db up -d --no-build --pull never

Things to know

• !Refresh Tokens, upstream identity federation and cross-application logout are not supported.
• !Designed for single-organization, single-instance use by small teams.
• !Production use requires configuring your own HTTPS reverse proxy and secrets.
• !Early-stage project with few stars and a 0.1.x release version.

Topics

FAQ

What is burrow?

A lightweight, self-hosted OpenID Connect identity provider for small teams, with password login, mandatory TOTP and RBAC. Burrow is a self-hosted OpenID Connect identity provider aimed at small teams and internal services. It centralizes user accounts, shared single sign-on and application access in one single-organization, single-instance service. The Go backend and React UI ship as one binary, or can run alongside PostgreSQL through Docker Compose.

Is burrow free to use? What license does it have?

burrow is open source under the MIT license. Check the license terms before using it in commercial products.

Is burrow still maintained?

Actively maintained. The last commit to burrow was on Oct 11, 2026.

What can I use burrow for?

Giving a small team one login for Grafana, Harbor and other self-hosted internal tools. Adding OIDC-based SSO to self-hosted services without running Redis or a message queue. Enforcing TOTP two-factor login for all accounts on an internal network.

How do I install burrow?

Download the deployment archive from Releases and extract it: tar -xzf "burrow_${BURROW_RELEASE}_deploy.tar.gz" Enter the deployment directory and create the env file: cp .env.example .env Edit .env with HTTPS issuer, secrets and database password, then start with Docker Compose: docker compose --profile local-db up -d --no-build --pull never

Where can I get burrow?

The source code and installation instructions are on GitHub: https://github.com/ArkGravity/burrow