SSO, mTLS, JWT — without writing auth code.
Plug any OIDC, SAML or mTLS provider in front of any tunnel in three lines. t-Gates validates tokens, refreshes sessions, and forwards verified identity claims to your origin.
Bring your existing identity provider — no changes required.
Wire up Okta, Azure AD, Google, Auth0, JumpCloud or any OIDC/SAML 2.0 provider. t-Gates handles the discovery dance, key rotation, and JWKS caching. Your users keep their existing SSO experience.
- ✓Auto-discoveryPoint at the issuer URL. We pull config + JWKS automatically.
- ✓Group-based accessMap IdP groups to tunnels with one declarative rule.
- ✓JIT provisioning + SCIMUsers appear in t-Gates the moment they're added in your IdP.
Service-to-service auth without a sidecar mesh.
Issue short-lived workload certificates. Rotate them every 24 hours. Verify them at the edge. t-Gates runs a fully-managed PKI so you don't have to operate cert-manager, Vault PKI, or Istio Citadel.
- ✓SPIFFE-compliant IDsWorkload identities follow the SPIFFE spec — interoperable with Istio, Linkerd.
- ✓Auto rotationCerts rotate every 24h. Roots every 90 days. Zero downtime.
- ✓CRL + OCSP staplingRevocation propagates globally in under 4 seconds.
Delete your auth middleware.
Every framework has its own. Every framework has its own bugs. Push it to the edge and your origin code shrinks.
import jwt from 'jsonwebtoken';
import { jwksClient } from 'jwks-rsa';
const client = jwksClient({
jwksUri: 'https://auth/.well-known/jwks.json',
cache: true, rateLimit: true,
});
app.use(async (req, res, next) => {
const token = req.headers.authorization?.split(' ')[1];
if (!token) return res.sendStatus(401);
try {
const { kid } = jwt.decode(token, { complete: true }).header;
const key = await client.getSigningKey(kid);
const claims = jwt.verify(token, key.getPublicKey());
req.user = claims;
next();
} catch { res.sendStatus(401); }
});# policy.tg
route "/*" {
auth = oidc("auth.t.gate")
}
// app.ts — that's it
app.get('/', (req, res) => {
res.json({ user: req.headers['x-tg-user'] });
});Auth that actually covers the edge cases.
Refresh, revocation, device trust, step-up — all of it built in.
Token refresh
Silent refresh handled at edge. Origins see a valid token always.
refresh = silentStep-up auth
Trigger MFA challenges for sensitive routes mid-session.
step_up = mfa_requiredSession revoke
Kill all sessions for a user globally in under 2s.
tgate session revokeDevice posture
Block requests from devices missing your CrowdStrike beacon.
device.compliant = trueJust-in-time access
Time-boxed elevated tokens approved via Slack.
elevate for 30mAudit log
Every authn/authz decision logged with full context.
audit_log = retained_1yWe had eleven different auth implementations across our services. Every team rolled their own. Moving auth to t-Gates's edge let us delete a year's worth of duplicated code in two sprints — and our SOC 2 auditor was thrilled.
Move auth out of your apps.
One config replaces a dozen middleware libraries. Your engineers stop debugging JWT clock skew.