Protect internal tools with a single binary.

Every internal tool, admin panel, and staging environment needs authentication. The default approach is to bolt a login page onto each service individually, which means maintaining session logic, password hashing, and token validation in every codebase. An auth proxy sits in front of all your services and handles authentication at the network level. Requests arrive at the proxy, the proxy checks credentials, and only authenticated traffic reaches the upstream service. The upstream never sees unauthenticated requests and never needs its own login code.

Gate is a reverse proxy that authenticates every request before forwarding it to your upstream service. It supports API key authentication (pass a Bearer token), session-based login (username and password through a browser form), and IP allow/deny lists. Rate limiting is built in — configure requests per minute per IP. The admin API lets you manage users, keys, and access logs programmatically. The access log records every request with timestamps, IP addresses, and user identifiers.