wicket

Share your self-hosted MCP servers, APIs, and dashboards with a few friends. No identity provider needed.

I wanted to share my self-hosted service with 3 friends. And let one of them into my MCP server deployed on the same machine, but not the other two.

I needed:

• token-based auth
• simple admin panel
• be able to attach to the different proxies

I looked at what existed:

• Authelia / Authentik / Zitadel: full SSO, designed for companies. Overkill.
• tinyauth: it does user/session auth with login UI; I want pre-shared bearer tokens for API clients, not browser sessions.
• OAuth2-proxy: needs an upstream identity provider I'd have to run too.
• nginx basic auth: no per-resource rules, no rotation, no administration.

So I built this: a FastAPI service that your reverse proxy (Caddy or Traefik) calls via forward-auth. Create a bearer token in the admin UI, assign it to specific hostnames, hand it to your friend.

They add Authorization: Bearer <token> to requests.

• You self-host a few services: MCP servers, scrapers, pet projects, internal APIs, dashboards
• You want to share them with a small trusted group
• You don't want to run an identity provider
• You don't want to depend on a third-party SaaS

• You need real SSO, audit logs, or user-attribute policies: use Authelia / Authentik / Zitadel
• You have hundreds of users: the admin UI doesn't have search or grouping yet, so it gets painful fast.

• Bearer-token auth with per-host ACL: one token can grant access to multiple services, or just one
• Tiny admin UI for issuing, and revoking tokens
• Token TTLs for auto-expiry

git clone https://github.com/trofkm/wicket
cd wicket
cp env.example .env   # set env variables

docker compose up --build

docker compose -f docker-compose.redis.yml up --build

Open http://localhost:8000 for the admin UI. Sign in with ADMIN_USER / ADMIN_PASS, create a token for your service's hostname, and wire up your proxy:

yourmcp.example.com {
    forward_auth wicket:8000 {
        uri /auth
    }
    reverse_proxy yourmcp:3002
}

services:
  yourmcp:
    labels:
      - "traefik.http.routers.yourmcp.middlewares=wicket-auth@docker"
      - "traefik.http.middlewares.wicket-auth.forwardauth.address=http://wicket:8000/auth"
      - "traefik.http.middlewares.wicket-auth.forwardauth.trustForwardHeader=true"

See example/ for full-stack Docker Compose setups.

  Client
    │
    │  GET https://yourmcp.example.com/
    │  Authorization: Bearer <token>
    ▼
  Reverse proxy
    │
    │  forward-auth: GET /auth
    │  X-Forwarded-Host: yourmcp.example.com
    ▼
  wicket (this service)
    │
    │  lookup in storage
    │  is the host in this token's allowlist?
    ▼

The admin UI shows you the raw token only once, on creation.

Your reverse proxy calls this endpoint. Returns the verdict for a single request.

Responses: 200 OK (allow), 400 (missing X-Forwarded-Host), 401 (missing/invalid token or host not allowed), 503 (store unavailable).

Always 200 OK. Liveness probe.

200 OK when the storage backend is reachable, otherwise 503. Readiness probe.

Prometheus metrics endpoint. Exposes:

• GET /: token manager
• POST /create_token: fields: hosts (required, comma-separated), email, comment, ttl_seconds
• POST /delete_token: field: token

Supports two storage backends, selected via STORAGE_BACKEND:

Redis backend only:

• Front this with HTTPS Bearer tokens are sensitive. Don't send them over plain HTTP.
• The admin UI uses Basic Auth. For exposed deployments, add an IP allowlist, a NetworkPolicy, mTLS, or put the UI behind a separate route.

MIT