# vouch/vouch-proxy

an SSO and OAuth / OIDC login solution for Nginx using the auth_request module

Repository: https://github.com/vouch/vouch-proxy
Canonical: https://ross.abutalabs.com/products/vouch-proxy
Language: Go
License: MIT
License Family: permissive
Topics: nginx, nginx-proxy, sso, oauth2, jwt, lasso, sso-login, sso-solution, authentication, golang
Last push: 2026-07-03T20:14:02+00:00

## Health v2 (maintenance only)
Score: 73/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 90, release rhythm 35, longevity 100
- inputs: {"age_days": 3330, "days_push": 61, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3280, forks 339 (observed 2026-08-28T04:07:53.571781+00:00)

## What it is
Vouch Proxy is an SSO and OAuth/OIDC authentication proxy for Nginx that uses the auth_request module to protect upstream sites. It supports many identity providers including Google, GitHub, Okta, Azure AD, and Keycloak, issuing JWTs after login.

## Use cases
- add single sign-on to nginx-hosted sites
- protect internal apps behind nginx with oauth2 login
- authenticate nginx reverse proxy with oidc provider
- enforce sso across multiple websites
- use auth_request to gate access to self-hosted services
- integrate keycloak or azure ad login with nginx

## When to choose
- you run Nginx as a reverse proxy and want centralized SSO
- you need broad OIDC/OAuth provider compatibility
- you want a lightweight Go proxy with sub-millisecond validation

## When to avoid
- you use Caddy or Traefik with built-in forward auth instead of Nginx
- you need a full identity provider rather than a proxy
- you want a GUI-managed auth solution

## Facets
- artifact type: service
- maturity: active
- function: auth, http-server, middleware, security
- domain: security, web-development, self-hosted, backend
- platform: self-hosted, go, cross-platform
- tags: sso, oauth2, oidc, nginx, auth-request, jwt, reverse-proxy, single-sign-on, linux, docker

## Member repositories
- vouch/vouch-proxy (main) score 73

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:53.571781+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:43:20.179224+00:00, confidence not recorded.
  - readme: https://github.com/vouch/vouch-proxy (fetched 2026-08-28T04:07:53.571781+00:00, sha f455bca2a1e6)
- Data as of 2026-08-30T08:39:29.467469+00:00.