Authentication

Marmot supports multiple OAuth/OIDC providers for Single Sign-On authentication. You can enable multiple providers simultaneously, and users will see login buttons for all enabled providers.

note

These pages cover signing users in to Marmot through an external identity provider. For AI assistants and MCP clients that authenticate against Marmot's own built-in OAuth server, see MCP authentication.

Supported Providers

Generic OIDC

Any OIDC-compliant provider with team synchronisation

Google OIDC

OpenID Connect authentication with Google Workspace

GitHub OAuth

OAuth 2.0 authentication with GitHub

GitLab OIDC

OpenID Connect for GitLab SaaS and self-hosted

Keycloak OIDC

OpenID Connect with team synchronisation

Okta OIDC

OpenID Connect with team synchronisation

Slack OIDC

OpenID Connect authentication with Slack

Auth0 OIDC

OpenID Connect with team synchronisation

How It Works

Email-Based Linking

User accounts are linked by email address across all providers

Multiple Providers

Enable as many providers as you need - users choose at login

Prerequisites

Before configuring any authentication provider, you must set server.root_url to the public URL of your Marmot instance. This is used to generate OAuth callback URLs.

server:
  root_url: https://marmot.example.com

Or via environment variable:

export MARMOT_SERVER_ROOT_URL=https://marmot.example.com

Setup Steps

Each provider requires:

1. Set server.root_url - The public URL users access Marmot from
2. Create OAuth App - Register an application in the provider's developer console
3. Configure Marmot - Add credentials via environment variables or config file
4. Restart Marmot - Changes take effect after restart

See individual provider guides above for detailed setup instructions.