Self-host Tinyauth
updated Aug 2026deployed by usprices checked · Jul 2026Install verified on Ubuntu 26.04 · Aug 2026 · how we test
We earn commissions when you shop through the links below. Full disclosure →
The tiniest self-hosted login screen for your apps — a single small Go container that adds authentication, OAuth login, and access controls in front of Traefik, Nginx, or Caddy, and since v5 doubles as an OpenID Certified OIDC provider.
Key facts
CategorySSO & Identity
LicenseAGPL-3.0
StackGo
Min RAM256 MB
Official imageyes
Measured idle RAM8 MB
Difficulty
Our recommendation
Pick Tinyauth when you want the smallest possible login screen in front of apps that have none — one Go container that plugs into Traefik, Nginx, or Caddy as forward auth, with local users, OAuth login, and access controls. Since v5 it's also an OpenID Certified OIDC provider, but if you need a real user directory, SAML, or LDAP, step up to Authelia or authentik.
Follow the Tinyauth deploy guide →What you need
- Any VPS with at least 256 MB of RAM
- A domain you control — most self-hosted setups need HTTPS in front of them
- Under an hour if you've used Docker before
Where to host itaffiliate disclosure
Hetzner Cloudrun it on
From $23.59/mo · 2 vCPU / 4 GB / 80 GB · EU + USKamaterafree trial
From $4/mo · 1 vCPU / 1 GB / 20 GB · US + EU + AsiaDigitalOceanalso works on
From $6/mo · 1 vCPU / 1 GB / 25 GB · US + EU + AsiaPaid link — we earn a commission if you shop through it.
Install with Docker Compose
Save this as compose.yml and run docker compose up -d:
# Tinyauth — single container; wire it to your proxy via forward auth
services:
tinyauth:
image: ghcr.io/tinyauthapp/tinyauth:v5
ports: ["3000:3000"]
environment:
# a real domain — Tinyauth rejects bare IPs (and underscores) in APPURL
- TINYAUTH_APPURL=http://tinyauth.example.com:3000
- TINYAUTH_AUTH_USERS=user:$$2a$$10$$UdLYoJ5lgPsC0RKqYH/jMua7zIn0g9kPqWmhYayJYLaZQ/FTmH2/u
volumes: ["./data:/data"]
# docker compose up -d → http://tinyauth.example.com:3000 (user / password — change both)
# then point your proxy's forward-auth at http://tinyauth:3000/api/auth/<proxy>deploy guideHow to Deploy Tinyauth on a VPSvps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly
What you take on
Tinyauth trades features for size on purpose — know what you're not getting:
non-negotiableIt's young and moving fast. The project itself warns that configuration changes often between releases — read the release notes before every update, and expect the occasional breaking rename.
non-negotiableIt gates apps; it doesn't manage identity. There's no user directory, groups UI, SCIM, or SAML — users live in an environment variable, a users file, an LDAP server, or an OAuth provider. Fine for a homelab, wrong for a team with churn.
non-negotiableIt's AGPL-3.0. That only matters if you modify it and offer it as a network service, but some organisations screen AGPL out — check before standardising on it.
Head-to-head
More in SSO & Identity
SSO & Identity
Authelia
Go
moderateRead guide →
SSO & Identity
authentik
PythonGoTypeScript
moderateRead guide →
SSO & Identity
Casdoor
GoReact
easyRead guide →
SSO & Identity
Keycloak
JavaQuarkus
hardRead guide →