GateKeeper

Appearance

GateKeeperGateKeeper

One sign-in for everything you self-host

An authentication server in a single container. Protect any app with OIDC or your reverse proxy, and sign in with passkeys, an authenticator, an emailed code, or your phone.

Get StartedFeaturesGitHub
The GateKeeper dashboardThe GateKeeper dashboard
GateKeeper on a tabletGateKeeper on a tablet
GateKeeper on a phoneGateKeeper on a phone

Put a front door on your homelab

One container, a SQLite file, and everything else configured from the admin panel.

docker pull ghcr.io/chr0nzz/gatekeeper:latest

Free and open source. If it saves you time, a star goes a long way.

Star on GitHub InstallScreenshots

Features

Everything needed to put a single sign-in in front of what you run.

Sign-in

Six ways in, one page

Password with an emailed code, passwordless codes, an authenticator app, a passkey, a QR code scanned with your phone, or GitHub, Google and Discord. When an app starts the sign-in, its own name and icon appear on the page.

Explore Sign-in →
Six ways in, one pageSix ways in, one page
Dashboard

See what is happening right now

Live sign-in activity, failed attempts, token counts and two-factor adoption, with a health panel that surfaces the accounts and settings that need attention.

Explore Dashboard →
See what is happening right nowSee what is happening right now
OIDC

An identity provider for every app

Register a client and any app that speaks OpenID Connect can hand sign-in to GateKeeper. Authorization code with PKCE, RS256 tokens, group claims for role mapping, and custom claims per client. Mobile apps work too.

Explore OIDC →
An identity provider for every appAn identity provider for every app
Policies

Decide who reaches which app

Named policies control access per application, whether it signs in through OIDC or sits behind your reverse proxy. For apps with no sign-in of their own, stored credentials are injected on the way through.

Explore Policies →
Decide who reaches which appDecide who reaches which app
Audit log

An append-only record of everything

Every authentication and admin event, filterable by category, outcome, sign-in method and date, and exportable as CSV. Failed sign-ins record why they failed and which address was tried.

Explore Audit log →
An append-only record of everythingAn append-only record of everything
Backups

Encrypted snapshots, restored in a click

Scheduled or on-demand snapshots encrypted with AES-256-GCM, stored locally or in any S3-compatible bucket. Restoring stages the database and completes on the next restart.

Explore Backups →
Encrypted snapshots, restored in a clickEncrypted snapshots, restored in a click
More in the box

It keeps going

PasskeysSign in with Touch ID, Face ID or a hardware key. No password, no code.QR code sign-inScan with your phone and approve. The other device signs in on its own.ForwardAuthProtect any app at Traefik, Nginx or Caddy without touching its code.GroupsGroup membership rides along in every token for role mapping in your apps.Social loginGitHub, Google and Discord, linked automatically when the email matches.Invite linksSingle-use registration links with an expiry, tied to an address or open.WebhooksSend auth events to Discord, Slack, Telegram, ntfy or any HTTP endpoint.Admin API keyA personal key per admin for dashboards and scripts, sent as a header.
On your phone

The whole thing fits in a pocket

Every page adapts down to a phone, and both the user portal and the admin panel install to the home screen as their own app. Same light and dark themes.

GateKeeper on a phoneGateKeeper on a phone
GateKeeper on a phoneGateKeeper on a phone
GateKeeper on a phoneGateKeeper on a phone
Install as an app →