Features

SSO across your apps

Useful if you want one login for several applications without changing the applications.

One authentication provider, one login host and a shared cookie domain across applications.

SSO across different domains

Useful if your applications live on unrelated domains and you want one IdP login without a second form.

ssoGroups declares the shared OIDC/client/session settings once, one provider per domain, and routes.hosts expands one route body across those domains.

Feature Example

Multiple identity providers

Useful if your users come from several identity providers and you already run an IAM.

Use Keycloak, Zitadel or another OIDC IAM to federate Google and other IdPs behind one issuer.

Feature Example

Embedded IAM

Useful if you want IdP federation and managed user grants without running an external IAM.

The lightweight cladone-auth embedded IAM maps IdP claims to a common roles/scopes/claims model and manages local and federated users.

Feature Example

Horizontal scaling

Useful if you need several Gate One replicas behind a load balancer.

Shared Redis session/revocation state and a common signing key make logout and revocation effective across replicas.

Feature Example

Protect APIs and MCP tools

Useful if you expose APIs or MCP tools to authenticated users and machine clients.

Route-level identity conditions, JWT/JWKS validation for APIs, and MCP protected-resource metadata with audience and scope checks.

Feature Example

Expose REST APIs and MCP servers as MCP tools

Useful if you want MCP clients to reach services that do not speak MCP.

Derive tools from an OpenAPI document, proxy an existing MCP server, and aggregate several services under one endpoint with its own audience, scope and identity.

Feature Example

Call services with the user's credentials

Useful if a route or an MCP tool must call an external service as the signed-in user.

The token broker stores a per-user token; upstream.delegated injects it into API and MCP requests, and the user badge links to the connections page.

Feature Example

Injectable UX

Useful if you cannot modify the frontend but need a user badge, a guard, gated controls or a PWA shell.

HTML/JS/CSS injection, declarative UI gating, a 403 banner and a strict CSP — without touching the application source.

Feature Example

Bring your own account panel

Useful if you own the application UI and want the account details in your own burger menu.

Read the Gate One session probe and render the user, roles, scopes and claims without the built-in badge.

Feature Example

Usage events and plugins

Useful if you need metering, audit, observability, or a commercial extension.

Durable per-type WAL, signed out-of-process plugins, targeted 503 on backpressure and an opaque subjectId instead of user data.

Feature Example

Cloudflare Turnstile on any form

Useful if you want to stop bots on a public form, including a page Gate One already proxies.

One platform-wide block injects the widget into forms or gates whole pages/actions with a signed 30-minute clearance cookie.

Feature Example