nginx auth_request via remote api

Project status: Production use since 2017.

This program intended to be used for client authentication with

• nginx http auth_request module
• traefik ForwardAuth

OAuth2 services supported:

• gitea

Also, narra accepts auth via header with Gitea Access Tokens for non-interactive use cases, see dcape-config-cli.

Usage example available inside dcape project.

narra is available as docker image at

• GitHub container registry

See config.md

See CHANGELOG.md

Chain of requests with warning Cookie decode error: securecookie: the value is not valid in logfile means you have the same cookie for upper domain. This is configuration problem and you should rename one of these cookies (see --as.cookie_name).

• using-the-nginx-auth-request-module
• traefik-oauth2-proxy

• traefik-forward-auth (cannot be used while this PR open)
• oauth2-proxy (waiting for this and probably more)
• for nginx: vouch-proxy (waiting for this)
• buzzfeed/sso
• pomerium
• external-auth-server

Primary goal was to allow logins via gitea API. Starting from v0.10 narra uses OAuth2 services like gitea or mattermost.

Since v0.20 narra can act as Traefik2 ForwardAuth service.

The MIT License (MIT), see LICENSE.

Copyright (c) 2017-2025 Aleksei Kovrizhkin lekovr+dopos@gmail.com