AuthPortal
Self-hosted SSO gateway for Plex, Jellyfin and Emby
98 stars 1 forks last commit first released GPL-3.0
Actively maintained
Last commit 19 Aug 2026.
AuthPortal is a lightweight, Go-built authentication gateway that provides a unified login experience for Plex, Jellyfin, and Emby users. It issues signed session cookies, offers an admin console, and can act as an OAuth 2.1 / OIDC authorization server for downstream apps.
Key Features
- Unified login flows for Plex (PIN flow), Jellyfin, and Emby with provider-specific handling.
- Signed, HTTP-only JWT session cookies and session lifecycle management.
- Optional TOTP-based multi-factor authentication with recovery codes and per-tenant enforcement.
- Built-in OAuth 2.1 / OIDC endpoints (discovery, JWKS, token, userinfo) with PKCE and refresh support.
- Admin SPA for runtime config editing (providers, security, MFA), OAuth client management, and encrypted config backups with scheduling/retention.
Use Cases
- Provide single sign-on for a media-focused community (Plex/Jellyfin/Emby) across internal portals and apps.
- Act as a lightweight first-party OIDC authorization server for home-lab or intranet applications.
- Centralize MFA enforcement, OAuth client lifecycle, and runtime configuration for downstream services.
Limitations and Considerations
- Designed for same-origin / intranet scenarios; production use requires proper HTTPS reverse proxy and careful key management (SESSION_SECRET, DATA_KEY).
- Relies on Postgres for user/profile storage and expects you to manage DB availability, backups, and secret rotation.
AuthPortal is intended for self-hosting in home-lab and media community environments. It emphasizes a small runtime footprint, containerized deployment, and extensible provider support while requiring operators to follow security best practices and manage secrets and backups carefully.
Categories:
Tags:
Tech Stack:
Similar to AuthPortal
Authelia
Self-hosted IAM with SSO and multi-factor authentication
Authelia is an open-source IAM and authentication server providing SSO, MFA, and access control for web apps, with OpenID Connect/OAuth 2.0 and reverse-proxy integration.
Kanidm
Simple, secure identity management and SSO provider
Kanidm is a secure identity management platform providing SSO, passkeys (WebAuthn), and integrations like OAuth2/OIDC, RADIUS, and LDAP gateway for legacy apps.
VoidAuth
Self-hosted SSO and user management with OpenID Connect and ForwardAuth
VoidAuth is a self-hosted SSO provider with OpenID Connect, ForwardAuth proxy auth, and built-in user and group management plus MFA and passkeys.
Authgear
Identity and authentication platform for apps and APIs
Open-source Auth0/Clerk/Firebase Auth alternative with passkeys, MFA, SSO (OIDC/SAML), user management portal, and extensible auth flows for web and mobile apps.
Listaway
Publish and share lists with team accounts and optional public links
Self-hosted app for creating, managing, and publishing lists and collections with team accounts, OIDC support, randomized public share links, and Postgres storage.
Keycloak
Open-source identity and access management with SSO
Keycloak is an open-source IAM server providing single sign-on, user federation, and centralized authentication and authorization using OIDC, OAuth 2.0, and SAML.