Explore Vouch by Smoke Turner LLC, an open-source Single Sign-On proxy that centralizes authentication for web services. It handles OAuth2 and OpenID Connect workflows to gate access to applications behind a reverse proxy. Key capabilities include provider support, encrypted session cookies, and a compact Go binary or Docker deployment. Targeted at DevOps and system administrators who need a self-hosted SSO solution with minimal operational footprint.

Vouch functions as an authentication proxy that sits in front of web apps

Vouch intercepts requests and enforces third-party logins, acting as an intermediary that completes OAuth2 and OpenID Connect flows before granting access. It is designed to pair with a reverse proxy and specifically integrates with Nginx using the auth_request module. Administrators can protect multiple services with a single login and configure domain- or user-specific access controls.

It keeps resource use small and fits container or binary deployment

Written in Go, Vouch targets high performance and low resource usage, making it suitable for lightweight hosts. The project distributes a single standalone binary and a Docker image, which simplifies deployment in containerized environments or on Windows and Linux servers. The developer positions Vouch as more efficient than heavier SSO suites, so it is appropriate where footprint matters.

Security posture relies on encrypted cookies and open-source transparency

Session management uses encrypted browser cookies to maintain authentication state without storing credentials on the backend. The project is open-source under an MIT-style license, which supports community review and audits. Vouch can be configured with multiple identity providers to limit exposure to single-provider outages and to split access by provider where needed.

Operational use expects infrastructure knowledge rather than novice setup

Vouch targets DevOps and system administrators who manage reverse proxies and identity provider credentials. Deployment choices include a single binary or Docker image, and configuration exposes options for domain-based or per-user access rules. Casual users need guidance, since proper reverse proxy configuration and provider setup are required to avoid misconfigurations.

Practical choice for teams that manage their own infrastructure, with a clear trade-off

Vouch is a pragmatic option for DevOps and sysadmins who need a self-hosted SSO proxy to protect multiple web services. The primary trade-off is the required familiarity with reverse proxy configuration and identity providers. Use Vouch when you control infrastructure and can manage provider credentials and cookie encryption; it performs reliably for teams preferring a lightweight, transparent authentication gateway over larger identity suites.