export OIDC_CLIENT_SECRET=... # the authProvider.clientSecretEnv variable
gate-one -check -config api-routes.json
gate-one -config api-routes.json # listens on :3000Components and installation
What the components are, where they come from, and how to install Gate One with the optional services.
Gate One is one binary in front of your applications. Everything else — an identity provider, the optional broker, the token broker, Redis — is a separate component you choose to run. See Components for a page per component.
The components
| Component | Role | Shipped as | Required? |
|---|---|---|---|
Gate One | The gateway: route policy, session, proxy, MCP, injection | Signed release binary | yes |
Identity provider | Identification and (optionally) authorization claims | External (Keycloak, Entra ID, Auth0, …) | yes |
Reverse proxy | TLS termination, routing, load balancing | External (Traefik, nginx, Caddy, …) | recommended |
| Optional embedded IAM / OIDC issuer (IdP federation, grants) | Signed release binary | optional |
auth-bridge | Reference implementation of the | Source | optional |
Token broker | Per-user delegated credentials for upstream calls | Source | optional |
Redis | Shared session/revocation state for several replicas | External (Sentinel) | only for HA |
All releases attach a single services_<version>_src.tar.gz containing
the auth-bridge and token broker sources. They are not part of the
gate-one binary: each runs as its own container.
Minimal install
Gate One + one OIDC provider + a TLS reverse proxy.
Download a release (
gate-one_<version>_<os>_<arch>.tar.gzfrom the release page or a signeddist/), verify it (see Publish and trust a plugin for the trust model), and extract it.Write
api-routes.json— start from Direct OIDC or Keycloak with Google.Validate, then start:
Put it behind the reverse proxy — TLS, the public host, and the OIDC callback URL. See Reverse proxy.
Probe it —
/healthz(liveness) and/readyz(readiness).
Optional components
cladone-auth (embedded IAM) — configure it and point Gate One at it with
authProvider.type: "oidc".auth-bridge — the reference implementation of the HTTP bridge contract, used with
authProvider.type: "http-bridge".Token broker — the service behind delegated credentials, declared in
tokenBroker.Redis — shared state required only for several replicas.
What is not a component
A Backend-For-Frontend is your application behind a
backend:route, not a Gate One service (see Plugins).Keycloak, Postgres and other platform services are yours to run; Gate One only needs an OIDC issuer (and Redis for HA).
Runnable deployments
The source repository ships two prepared deployments:
[
deploy/local/](https://github.com/clad-one/gate-one/tree/main/deploy/local) — demos on*.localhost: no domain and no external account. Four run without Docker (embeddeddevprovider); four run the real OIDC chain with Docker Compose and a local demo identity provider. Every runnable [example](/docs/examples/) links its demo.[
deploy/vps/](https://github.com/clad-one/gate-one/tree/main/deploy/vps) — the production shape: Traefik with Let’s Encrypt, Gate One,cladone-authand Google, ready to copy to a VPS.
Both mount prebuilt binaries from $BIN_DIR; neither builds Gate One.
Besides gate-one and cladone-auth, the demos use
gate-one-demo-idp — a fake OIDC provider shipped with each release and
never to be used in production.