Examples

Copyable, schema-validated configurations, some runnable on your machine.

Two kinds of example:

Runnable — a packaged demo under deploy/local/ in the source repository starts the whole stack on *.localhost (no domain, no external account). ./run.sh prints the URLs.
Configuration pattern — a realistic routes.json for a setup that needs an external service (Keycloak, Google, GitHub). It is schema-validated; adapt it to your infrastructure.

Example	What it shows	Runnable
Getting started	The embedded development identity provider, its default users and a user badge.	Yes, no Docker
Direct OIDC	One OIDC issuer used directly, with roles and scopes read from that issuer and no federation or IAM.	Yes, Docker
Multi-app SSO	A second application added to the same provider and cookie domain, reusing the login session.	Yes, Docker
Cross-domain SSO	Unrelated domains sharing one IdP session, one provider per domain.	Yes, Docker
Embedded IAM	`cladone-auth` federates an IdP, maps claims and stores user grants.	Yes, Docker
High Availability	Several Gate One replicas behind a load balancer with shared Redis state.	Yes, Docker
Own account panel	The application’s own burger panel reads the session instead of the built-in badge.	Yes, no Docker
Injectable UX	User badge, UI gating, injection bundle and a nonce CSP.	Yes, no Docker
Usage plugin	A signed audit plugin, a trust store, the WAL and per-type durability.
Turnstile	A public form and a whole-page gate protected by Cloudflare Turnstile, with the test keys.	Needs internet
Keycloak with Google	A classical external IAM: Keycloak federates Google, Gate One trusts one Keycloak issuer.	Pattern
APIs and MCP	A browser provider, a JWT provider, an identity-conditioned API route and an MCP service.	Pattern
MCP tools	A REST-derived MCP service, a proxied MCP server and an aggregating set.	Pattern
IAM + IdP bridge	An `http-bridge` provider returning identity and IAM facts.	Pattern
Enhance a proxied site	An external site proxied through Gate One with an injected userscript.	Needs internet

The runnable demos live in the source repository under deploy/local/. They need the Gate One binaries (download a release and verify the checksums) and, for the OIDC demos, Docker Compose.

The configuration files

The raw files are also served under /examples/:

The proxied-site example is kept in the source repository: examples/siteproxy/.

Production deployment

A starting point with Traefik, TLS, Gate One and cladone-auth, ready to copy to a VPS, is deploy/vps/.

Getting started

A local demo with the embedded development identity provider.

Direct OIDC with one IdP

Point Gate One straight at a single OIDC issuer, with no federation and no IAM.

Multi-app SSO

Add a second application to an existing login session.

Cross-domain SSO

One IdP login across app-a.com and app-b.fr, with one provider per domain.

Keycloak with Google

Federate Google in Keycloak, then point Gate One at one Keycloak issuer.

Embedded IAM

Federate IdPs in cladone-auth, map claims and assign user grants.

High Availability

Balance load across several Gate One replicas with shared session and revocation state.

APIs and MCP

A browser provider, a JWT provider and an MCP protected resource.

Own account panel

Replace the built-in user badge with a burger side panel owned by the application.

IAM + IdP bridge

An http-bridge provider returning identity and IAM facts while Gate One keeps policy enforcement.

MCP tools

A REST-derived MCP service, a proxied MCP server and an aggregating set, with delegated credentials.

Injectable UX

Badge, gating, injection bundle, 403 banner and CSP.

Enhance a proxied site

Proxy an external site through Gate One and inject a userscript into every HTML page.

Usage plugin

A signed audit plugin, a trust store and a durable WAL.

Turnstile protection

A public form and a whole-page gate protected by Cloudflare Turnstile.