Traefik Forward Auth is Free (open source). Gate is a self-hosted alternative at $2.99/mo. Here's when each makes sense.
| Gate | Traefik Forward Auth | |
|---|---|---|
| Hosting | Self-hosted, your infra | Requires Traefik proxy and an OAuth2 provider (Google, OIDC) |
| Data location | Your server, your disk | Your server (if self-hosted) |
| Free tier | 1 upstream, 5 users | Free |
| Pro pricing | $2.99/mo | Free (open source) |
| Dependencies | None (single binary + SQLite) | Docker, Postgres, etc. |
| Setup time | ~30 seconds | 15-30 minutes (self-host) |
| Dashboard | Built-in at /ui | Web UI |
| License | BSL 1.1 | Open source |
Gate is a single Go binary with embedded SQLite. Install it with one command, and you are running in under a minute. Your data stays on your server.
curl -fsSL https://stockyard.dev/gate/install.sh | sh
Teams evaluating Traefik Forward Auth alongside Gate tend to split on two axes: feature depth and data residency. Traefik Forward Auth wins on feature depth — it is a mature product with integrations, mobile apps, and a dedicated support team. Gate wins on residency — your reverse proxy and auth gateway data lives on your server in a SQLite file you can inspect, back up, and migrate without asking anyone for permission.
The operational difference is significant. Traefik Forward Auth requires you to trust their infrastructure, their security practices, and their business continuity. Gate requires you to run a process and keep the data directory backed up. If your server dies, restore the binary and the SQLite file to a new server. The entire recovery procedure fits in a single paragraph because there is nothing else involved.
Both Gate and Traefik Forward Auth offer self-hosted options, but the operational requirements differ. Requires Traefik proxy and an OAuth2 provider (Google, OIDC) Gate is a single binary with embedded SQLite — no containers, no external databases, no orchestration. The practical difference: Gate runs on a $5 VPS with no configuration. Self-hosting Traefik Forward Auth typically requires a more substantial infrastructure investment.
If you are currently using Traefik Forward Auth and considering Gate, start by running both in parallel. Install Gate on a test server, point your workflow at it for a week, and compare the experience. Gate's data directory is isolated — running a trial costs nothing beyond the compute. If Gate does not fit, delete the binary and the data directory. There is nothing else to clean up.
Single binary. Free to start. $2.99/mo for Pro.