Self-host Tinyauth
updated Aug 2026deployed & timed by usprices checked · Aug 2026Install verified on Ubuntu 26.04 · Aug 2026 · how we test
The tiniest self-hosted login screen for your apps — a single small Go container that adds authentication, OAuth login, and access controls in front of Traefik, Nginx, or Caddy, and since v5 doubles as an OpenID Certified OIDC provider.
Key facts
Our recommendation
Pick Tinyauth when you want the smallest possible login screen in front of apps that have none — one Go container that plugs into Traefik, Nginx, or Caddy as forward auth, with local users, OAuth login, and access controls. Since v5 it's also an OpenID Certified OIDC provider, but if you need a real user directory, SAML, or LDAP, step up to Authelia or authentik.
What you need
- Any VPS with at least 256 MB of RAM
- A domain you control — most self-hosted setups need HTTPS in front of them
- Under an hour if you've used Docker before
Install with Docker Compose
Save this as compose.yml and run docker compose up -d:
# Tinyauth — single container; wire it to your proxy via forward auth
services:
tinyauth:
image: ghcr.io/tinyauthapp/tinyauth:v5
ports: ["3000:3000"]
environment:
# a real domain — Tinyauth rejects bare IPs (and underscores) in APPURL
- TINYAUTH_APPURL=http://tinyauth.example.com:3000
- TINYAUTH_AUTH_USERS=user:$$2a$$10$$UdLYoJ5lgPsC0RKqYH/jMua7zIn0g9kPqWmhYayJYLaZQ/FTmH2/u
volumes: ["./data:/data"]
# docker compose up -d → http://tinyauth.example.com:3000 (user / password — change both)
# then point your proxy's forward-auth at http://tinyauth:3000/api/auth/<proxy>What you take on
Tinyauth trades features for size on purpose — know what you're not getting:
non-negotiableIt's young and moving fast. The project itself warns that configuration changes often between releases — read the release notes before every update, and expect the occasional breaking rename.
non-negotiableIt gates apps; it doesn't manage identity. There's no user directory, groups UI, SCIM, or SAML — users live in an environment variable or an OAuth provider. Fine for a homelab, wrong for a team with churn.
non-negotiableIt's AGPL-3.0. That only matters if you modify it and offer it as a network service, but some organisations screen AGPL out — check before standardising on it.
Head-to-head
More in SSO & Identity
SSO & Identity
Authelia
Go
moderateRead guide →
SSO & Identity
authentik
PythonGoTypeScript
moderateRead guide →
SSO & Identity
Keycloak
JavaQuarkus
hardRead guide →
SSO & Identity
Pocket ID
GoSvelteKit
easyRead guide →