AuthPortal

AuthPortal is a lightweight, Go-built authentication gateway that provides a unified login experience for Plex, Jellyfin, and Emby users. It issues signed session cookies, offers an admin console, and can act as an OAuth 2.1 / OIDC authorization server for downstream apps. (github.com)

Key Features

• Unified login flows for Plex (PIN flow), Jellyfin, and Emby with provider-specific handling.
• Signed, HTTP-only JWT session cookies and session lifecycle management.
• Optional TOTP-based multi-factor authentication with recovery codes and per-tenant enforcement.
• Built-in OAuth 2.1 / OIDC endpoints (discovery, JWKS, token, userinfo) with PKCE and refresh support.
• Admin SPA for runtime config editing (providers, security, MFA), OAuth client management, and encrypted config backups with scheduling/retention. (github.com)

Use Cases

• Provide single sign-on for a media-focused community (Plex/Jellyfin/Emby) across internal portals and apps.
• Act as a lightweight first-party OIDC authorization server for home-lab or intranet applications.
• Centralize MFA enforcement, OAuth client lifecycle, and runtime configuration for downstream services.

Limitations and Considerations

• Designed for same-origin / intranet scenarios; production use requires proper HTTPS reverse proxy and careful key management (SESSION_SECRET, DATA_KEY).
• Relies on Postgres for user/profile storage and expects you to manage DB availability, backups, and secret rotation. (github.com)

AuthPortal is intended for self-hosting in home-lab and media community environments. It emphasizes a small runtime footprint, containerized deployment, and extensible provider support while requiring operators to follow security best practices and manage secrets and backups carefully. (github.com)