Authelia
Reverse Proxy & GatewaysAuthentication and authorization server for reverse proxies
Replaces Okta, Cloudflare Access
Best SSO Reverse Proxy & Gateways for self-hosting
The 5 best SSO reverse proxy & gateways you can self-host, ranked by community traction.
authentik
Reverse Proxy & GatewaysOpen-source identity provider with proxy outpost
Replaces Okta, Auth0
Pangolin
Reverse Proxy & GatewaysSelf-hosted tunneled reverse proxy with identity access
Replaces Cloudflare Tunnel
OAuth2 Proxy
Reverse Proxy & GatewaysReverse proxy that adds authentication to any web app
Replaces Cloudflare Access
Pomerium
Reverse Proxy & GatewaysIdentity-aware reverse proxy for zero-trust access
Replaces Cloudflare Access, BeyondCorp
No apps match these filters.
At a glance
| App | Deploy effort | Difficulty | Min. RAM | License | ★ Stars |
|---|---|---|---|---|---|
| Authelia | Under-an-hour setup | Medium | 128 MB | Apache-2.0 | 29,257 |
| authentik | Under-an-hour setup | Medium | 1,024 MB | MIT | 25,950 |
| Pangolin | Under-an-hour setup | Medium | 512 MB | AGPL-3.0 | 23,085 |
| OAuth2 Proxy | Under-an-hour setup | Medium | 128 MB | MIT | 15,173 |
| Pomerium | Under-an-hour setup | Medium | 256 MB | Apache-2.0 | 5,042 |
Quick picks
- Most adopted: Authelia (29,257 GitHub stars).
- Lightest footprint: Authelia (from 128 MB RAM, against 1,024 MB for the heaviest here).
- Licensing: 2 of 5 use Apache-2.0; check the rest individually if you plan to modify and redistribute.
Every option here is open-source and self-hostable, tagged SSO within the reverse proxy & gateways category. Deploy effort is graded from published container recipes, not vendor claims — see the methodology.