Setting up tinyauth with Github OAuth

Tinyauth has builtin support for Github OAuth with just two environment variables. Most of the hard work happens on the Github side rather than tinyauth.

Requirements

For this guide you will need the following:

• Any domain name (.local works too)
• A Github account

Create the Github OAuth app

The first thing you need to do is create a Github OAuth app, this can be done by going to the Github developer settings and clicking New OAuth App. There you need to fill in the following information:

Application name -> Can be anything, e.g. Tinyauth

Homepage URL -> It is required for some reason, so simply put https://tinyauth.app, but it can be anything

Authorization Callback URL -> The only thing that is important here, you should fill in your domain and the /api/oauth/callback/github suffix, e.g. https://tinyauth.example.com/api/oauth/callback/github

After you fill in your information, click Register Application.

Get your credentials

After you create your application, you should see a screen like this:

Here make sure to note down your client ID. Now, let's create the client secret, this can be done by clicking the Generate a new client secret button. When you click it, Github will prompt you to login again and then it will create your secret which it will present like this:

Make sure to note this down as well since we will need it later and that's it, we are done with Github.

Configure tinyauth

Now that you have your client ID and secret, you can pass it to the tinyauth docker container:

tinyauth:
  container_name: tinyauth
  image: ghcr.io/steveiliop56/tinyauth:v3
  restart: unless-stopped
  environment:
    - SECRET=some-random-32-chars-string
    - APP_URL=https://tinyauth.example.com
    - USERS=your-email-password-hash
    - GITHUB_CLIENT_ID=your-github-client-id
    - GITHUB_CLIENT_SECRET=your-github-secret
  labels:
    traefik.enable: true
    traefik.http.routers.tinyauth.rule: Host(`tinyauth.example.com`)
    traefik.http.middlewares.tinyauth.forwardauth.address: http://tinyauth:3000/api/auth/traefik

WARNING

OAuth doesn't mean security, with the current setup everybody with a Github account can login to tinyauth as a normal user. If you would like to limit which users can login with OAuth, you can add the OAUTH_WHITELIST environment variable and only allow your email address to login. For more information check the configuration page.

TIP

Since you have OAuth enabled, you can now remove the USERS or USERS_FILE environment variables so as you can ony login with your OAuth provider.

And you are done! After you restart tinyauth and try to login to an app, you should have an additional option to login with Github.