Cladone G.O. Gate-One

Centralized common features.

Once and for all:

Cross-domain SSO authentication, internal AIM.
Back-end and Front-end access rights at DOM scale.
Cloudflare Turnstile protection on pages, forms or endpoints.
Web to mobile (PWA) and REST to MCP. Service authent. delegation.
Service aggregation and filtering, front-end proxy.
Customizable and injectable user interface.
All combinations are possible.
Versionable configuration files.

Dynamic instrumentation—applications run without modification.

One edge, four jobs. Authenticate users, enforce route policy, inject the missing UX, and stream pseudonymized usage events to signed plugins. The backend stays a normal HTTP application.

One login

Shared OIDC session across your applications, with a central logout and immediate revocation.

Any identity provider

Talk directly to Keycloak, Entra, Auth0 or Google, or let the optional embedded IAM federate several providers and local accounts.

APIs and MCP

JWT/JWKS validation, roles, scopes and MCP protected-resource metadata for browser and machine clients.

Injectable UX

User badge, login guard, gated controls, 403 banner and PWA shell — on a frontend you cannot modify.

Usage events

Durable per-type WAL, opaque subject ids, signed out-of-process plugins and targeted backpressure.

No plugin in the auth path

Extensions consume events; they never decide authentication. The trust boundary stays in the core.

Built for the apps you already have

Gate One is a reverse proxy. It matches a host and path, authenticates the request, applies the configured policy and forwards it. The application does not know it is behind an identity-aware proxy, unless you choose to send it the opaque subject header.

IAM and provider types · Read the architecture · Browse the examples · Generate a configuration