OAuth2 Proxy is Free (open source). Gate is a self-hosted alternative at $2.99/mo. Here's when each makes sense.
| Gate | OAuth2 Proxy | |
|---|---|---|
| Hosting | Self-hosted, your infra | Single binary, but requires an external OAuth2 provider and a reverse proxy |
| Data location | Your server, your disk | Your server (if self-hosted) |
| Free tier | 1 upstream, 5 users | Free |
| Pro pricing | $2.99/mo | Free (open source) |
| Dependencies | None (single binary + SQLite) | Docker, Postgres, etc. |
| Setup time | ~30 seconds | 15-30 minutes (self-host) |
| Dashboard | Built-in at /ui | Web UI |
| License | BSL 1.1 | Open source |
Gate is a single Go binary with embedded SQLite. Install it with one command, and you are running in under a minute. Your data stays on your server.
curl -fsSL https://stockyard.dev/gate/install.sh | sh
Teams evaluating OAuth2 Proxy alongside Gate tend to split on two axes: feature depth and data residency. OAuth2 Proxy wins on feature depth — it is a mature product with integrations, mobile apps, and a dedicated support team. Gate wins on residency — your reverse proxy and auth gateway data lives on your server in a SQLite file you can inspect, back up, and migrate without asking anyone for permission.
The operational difference is significant. OAuth2 Proxy requires you to trust their infrastructure, their security practices, and their business continuity. Gate requires you to run a process and keep the data directory backed up. If your server dies, restore the binary and the SQLite file to a new server. The entire recovery procedure fits in a single paragraph because there is nothing else involved.
Both Gate and OAuth2 Proxy offer self-hosted options, but the operational requirements differ. Single binary, but requires an external OAuth2 provider and a reverse proxy Gate is a single binary with embedded SQLite — no containers, no external databases, no orchestration. The practical difference: Gate runs on a $5 VPS with no configuration. Self-hosting OAuth2 Proxy typically requires a more substantial infrastructure investment.
Switching from OAuth2 Proxy to Gate is straightforward for most teams. Export your data from OAuth2 Proxy (most services offer CSV or JSON export), then POST each record to Gate's API. A migration script that reads the export and writes to /api/ endpoints typically takes less than 50 lines of code. The reverse migration is equally simple — Gate's SQLite database is a standard file you can query with any SQLite client.
Single binary. Free to start. $2.99/mo for Pro.