Repolode
Submit
tinyauthapp

tinyauthapp/tinyauth

A tiny authentication and authorization server that works as middleware for Traefik, Nginx and Caddy, or as a standalone SSO login server.

Open-source alternative to:OktaAuth0

View on GitHubWebsite
Stars
8,397
Forks
285
Open issues
46
Last commit
4 hours ago

What is it?

Tinyauth is an authentication and authorization server meant to sit in front of your apps. It can run as middleware for popular reverse proxies such as Traefik, Nginx and Caddy, so protected services get a login step without changes to their own code. It can also run as a standalone authentication server.

The project supports OAuth, LDAP and access-control rules, and it is certified as an OpenID Provider under the Basic OP profile. Its main audience is self-hosters and homelab users who want single sign-on and two-factor login in front of services that lack their own.

The project is written in Go and is distributed as a container image, with a documented getting-started guide and a demo instance on its website.

Key features

  • 01Works as middleware for Traefik, Nginx and Caddy reverse proxies.
  • 02Supports OAuth, LDAP and access-control rules.
  • 03Runs as a standalone authentication server.
  • 04Passes OpenID Connect Basic OP certification.

Use cases

  • Adding single sign-on in front of self-hosted apps that have no login system.
  • Protecting homelab services behind a reverse proxy with a central login.
  • Adding two-factor authentication to services that lack it.

Quick start

  1. 1

    Read the getting started guide in the documentation

  2. 2

    Optionally try the official docker-compose example with Traefik, Whoami and Tinyauth

    docker-compose.example.yml

Things to know

  • Tinyauth is in active development and configuration may change often, so read release notes before updating.
  • Licensed under AGPL-3.0, which requires source disclosure for modified versions run over a network.

Topics

#authentication#sso#oidc#reverse-proxy#selfhosted#totp#ldap#golang#2fa#caddy

FAQ

What is tinyauth?
A tiny authentication and authorization server that works as middleware for Traefik, Nginx and Caddy, or as a standalone SSO login server. Tinyauth is an authentication and authorization server meant to sit in front of your apps. It can run as middleware for popular reverse proxies such as Traefik, Nginx and Caddy, so protected services get a login step without changes to their own code. It can also run as a standalone authentication server.
Is tinyauth free to use? What license does it have?
tinyauth is open source under the AGPL-3.0 license. Check the license terms before using it in commercial products.
Is tinyauth still maintained?
Actively maintained. The last commit to tinyauth was on Oct 19, 2026.
What can I use tinyauth for?
Adding single sign-on in front of self-hosted apps that have no login system. Protecting homelab services behind a reverse proxy with a central login. Adding two-factor authentication to services that lack it.
How do I install tinyauth?
Read the getting started guide in the documentation Optionally try the official docker-compose example with Traefik, Whoami and Tinyauth: docker-compose.example.yml
Where can I get tinyauth?
The source code and installation instructions are on GitHub: https://github.com/tinyauthapp/tinyauth

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects