AuthProxy

The Cratis Stack

A gateway for the edges of your app

Every application eventually grows the same crop of edge concerns: who is this user, which tenant are they in, where does this request route, and how do you onboard someone who has been invited but doesn’t have an account yet. AuthProxy is a small .NET gateway that owns those edges — so each of your services can assume the request is already authenticated, already scoped to a tenant, and already enriched with identity.

The friction it removes

Without a gateway, every service re-implements the same boilerplate: an OpenID Connect handshake, tenant resolution from the host or a claim, a call to fetch the user’s profile, the invite-acceptance flow. It’s repetitive, it drifts between services, and it’s exactly the kind of code you don’t want copy-pasted across a fleet.

AuthProxy is a reverse proxy (built on YARP) that you put in front of your backend and frontend services. It authenticates the request, resolves the tenant, enriches the identity, and then forwards the request to your service — with the tenant and identity attached as headers. Your services trust the proxy and read those headers.

Standalone — not Cratis-only

AuthProxy is a plain ASP.NET Core service. It pairs naturally with Arc’s identity model (it calls a /.cratis/me endpoint to enrich identity, which Arc exposes), but it sits in front of any backend and frontend you point it at.

What it handles

Authentication

OpenID Connect and OAuth 2.0 (single or multi-provider), plus JWT Bearer. Unauthenticated requests are challenged or sent to a provider-selection page.

Authorization

Require a claim — a role, a group, a GitHub organization or team — before any request is forwarded. Authenticating everyone is not the same as letting everyone in.

Identity enrichment

Calls a /.cratis/me endpoint on your service and attaches the enriched identity to forwarded requests as a trusted header.

Multi-tenancy

Resolve the current tenant per request — from the host, a subdomain, a claim, the route, or a fixed value — with optional remote verification.

Invites & lobby

Invite-based onboarding with signed JWT tokens, plus an optional lobby service for users not yet assigned to a tenant.

How the docs are organized

There’s no code to write — AuthProxy is configured entirely through the Cratis:AuthProxy section of appsettings.json and runs as a container in front of your services. Each page under Configuration takes one edge concern and walks through how AuthProxy handles it and how you configure it.

Where to go next

Start by putting the proxy in front of a service — the configuration reference covers the full Cratis:AuthProxy shape.

Configuration reference

The complete Cratis:AuthProxy settings shape, service routing, and every topic below it.

Aspire hosting

Wire AuthProxy into a .NET Aspire AppHost alongside your other services.

Identity & access in Arc

How Arc models identity and authorization on commands and queries — the /.cratis/me endpoint AuthProxy enriches from.