Authentication

Marmot supports multiple OAuth/OIDC providers for Single Sign-On authentication. You can enable multiple providers simultaneously, and users will see login buttons for all enabled providers.

Note

These pages cover signing users in to Marmot through an external identity provider. For AI assistants and MCP clients that authenticate against Marmot's own built-in OAuth server, see MCP authentication.

Supported Providers

• Generic OIDCAny OIDC-compliant provider with team synchronisation
• Google OIDCOpenID Connect authentication with Google Workspace
• GitHub OAuthOAuth 2.0 authentication with GitHub
• GitLab OIDCOpenID Connect for GitLab SaaS and self-hosted
• Keycloak OIDCOpenID Connect with team synchronisation
• Okta OIDCOpenID Connect with team synchronisation
• Slack OIDCOpenID Connect authentication with Slack
• Auth0 OIDCOpenID Connect with team synchronisation

How It Works

• Email-Based LinkingUser accounts are linked by email address across all providers
• Multiple ProvidersEnable as many providers as you need - users choose at login

Prerequisites

Before configuring any authentication provider, you must set server.root_url to the public URL of your Marmot instance. This is used to generate OAuth callback URLs.

server:
  root_url: https://marmot.example.com

Or via environment variable:

export MARMOT_SERVER_ROOT_URL=https://marmot.example.com

Setup Steps

Each provider requires:

1. Set server.root_url - The public URL users access Marmot from
2. Create OAuth App - Register an application in the provider's developer console
3. Configure Marmot - Add credentials via environment variables or config file
4. Restart Marmot - Changes take effect after restart

See individual provider guides above for detailed setup instructions.