ProxyAuth is an authenticating reverse proxy. It terminates TLS, checks who's asking, rate-limits them, and forwards the request — no separate auth service, no external identity provider, no assembly required.
Most auth stacks are a proxy, an OAuth sidecar, a session store, and a rate limiter, wired together. ProxyAuth is one process that does all four — so there's one thing to deploy, one thing to patch, one log to read.
Users live in your own config — Argon2id-hashed, checked locally. No Okta tenant, no Google Workspace, no dependency on a third party being up before your users can log in.
No garbage collector pauses under load, no class of memory-safety bugs to patch later. The same reasons Rust suits a browser engine suit the thing standing in front of every request your API gets.
Once a token checks out, ProxyAuth injects x-user and x-user-roles on the way through. Your backend reads a header — it never has to know a token existed.
Add instances behind a load balancer, sync revocation over Redis, and share cryptographic identity between them with a GPG-encrypted keystore export. No re-architecture required.
A client authenticates once and gets back an encrypted token. Every request after that carries the token; ProxyAuth verifies it, attaches the caller's identity, and forwards the request — your backend never touches a credential.
The client sends a username and password to ProxyAuth — the only place credentials are ever checked.
Why should every component have its own session system when the entire infrastructure can share the same token model?
Two independently-built ProxyAuth instances don't compute tokens the same way by default — each has its own random build constants baked in at compile time. proxyauth sync export hands them from one instance to another over a GPG-encrypted file, so a token issued anywhere in the cluster validates everywhere in it.
Instance A and Instance B both run ProxyAuth, but each was compiled separately — each has its own random build-time constants. Right now, a token issued by one would not validate on the other.
A route can point at several backends instead of one, weighted however you like. ProxyAuth sends each request to a backend picked by weighted round-robin — and if that backend doesn't respond, the same request just moves on to the next one in rotation. Zero requests lost, not a separate retry mechanism bolted on.
Login attempts and proxied API traffic are rate-limited independently — a burst of bad login attempts can't drown out real API traffic, and vice versa. Requests within the limit pass straight through; anything over the burst gets a clean 429, not a dropped connection.
/auth traffic, another for all proxied traffic. Finer-grained, per-route rate limiting (different limits for different endpoints behind the same ProxyAuth instance) is a natural improvement planned for a future release.
Set log.type: "loki" and ProxyAuth streams its logs to Grafana Loki. From there, Grafana can search, filter and turn raw requests into live operational signals.
{app="proxyauth"}▸ statusEvery cryptographic decision uses a well-studied, widely deployed primitive — chosen for what it's actually good at, not for how it sounds in a pitch.
Pick a channel. The installer detects your distro, builds the binary, sets up the proxyauth system user, and registers a service — systemd or OpenRC.
# install the latest stable release $ curl -fsSL https://proxyauth.app/sh/install | bash # confirm it's running $ sudo systemctl status proxyauth
# track the beta channel $ curl -fsSL https://proxyauth.app/sh/beta-install | bash # or pin an exact version $ curl -fsSL https://proxyauth.app/sh/install@0.8.13 | bash
# clone the official Docker setup $ git clone https://git.proxyauth.app/ProxyAuth/Docker ProxyAuth && cd ProxyAuth/latest # fix ownership (container runs as uid/gid 1000) $ sudo chown 1000:1000 config/config.json config/routes.yml # build and start $ docker compose build && docker compose up -d
One command. No account required, no external service to configure first.