YOUR APP FORGOT AUTH.

01 / SETUP

Build from a source checkout.

This interactive preview demonstrates the landing page. The gateway remains unreleased and its source is private. An authorized source checkout is required to run these commands.

bun install --frozen-lockfile
bun run build
./dist/ugh init

02 / REQUEST PATH

Your app stays your app.

1. Configure one local user. Keep password material out of versioned configuration.
2. Place Ugh Auth before the app. Inline proxy is the recommended default; forward auth fits an existing proxy.
3. Let verified requests through. Each session is bound to its configured site.

03 / SECURITY BOUNDARY

Small surface. Serious boundary.

Passwords

Argon2id local-user hashes; plaintext passwords never enter versioned configuration.

Sessions

Site-bound and stateless. The default lifetime is 12 hours; the maximum is 30 days.

Traffic

HTTP streaming, server-sent events, and WebSockets are release-gated behavior.

Sites

Multiple independently isolated sites are supported.

State

No database and no hosted dependency.

04 / DEPLOY

One binary. Or one container.

Run the Bun CLI, a standalone binary, or the non-root OCI image.

Use Docker Compose, Dokploy, Traefik, or Caddy for the surrounding deployment.

Vercel is landing-only. It serves this static page; it is never the Ugh Auth gateway runtime.

05 / DELIBERATE LIMITS

Authentication without an identity platform.

Ugh Auth is not signup, account recovery, OAuth/OIDC, email, passkeys, RBAC, organizations, billing, analytics, or a hosted identity platform. That absence is the scope: a small local gate, not a future product ladder.