Choose the authentication mode that matches this deployment.
Self-hosted behind a trusted network, VPN, or access proxy
Use only when DMARQ is protected outside the app. Public unauthenticated deployments are blocked in production unless explicitly allowed.
Hosted or self-hosted OIDC identity provider
Set LOGTO_ENDPOINT, LOGTO_APP_ID, and LOGTO_APP_SECRET.
Direct Authentik OAuth2/OpenID provider
Create an Authentik OAuth2/OpenID provider and set AUTHENTIK_ISSUER_URL, AUTHENTIK_CLIENT_ID, and AUTHENTIK_CLIENT_SECRET.
Trusted proxy / Authentik Outpost
trusted_proxy
Reverse-proxy enforced SSO in front of DMARQ
Use only when the proxy is the sole public path to DMARQ and strips any incoming spoofed identity headers.
Provider-neutral OIDC for Keycloak, Entra ID, Google, Okta, and others
Set OIDC_ISSUER_URL, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, and optionally OIDC_PROVIDER_LABEL plus allowlists.
Self-hosted or enterprise Keycloak realm/client
Use AUTH_MODE=oidc and set OIDC_PROVIDER_LABEL=Keycloak.
Commercial enterprise IdP
Use AUTH_MODE=oidc with the Entra issuer and group/app-role claims.
Google-managed identity for self-hosted or team deployments
Use AUTH_MODE=oidc and restrict access with OIDC_ALLOWED_EMAILS or domains.
