What is tobab?

tobab is a lightweight identity-aware proxy that enables passkey-based authentication for self-hosted services. It acts as a forward authentication target for reverse proxies like Caddy, nginx, or Traefik, providing single sign-on across subdomains. The project is written in Go and uses an embedded BoltDB database via the storm library for persistence. It runs as a single Docker container with configuration via a TOML file. The first user to register becomes the admin and can manage access through a web UI. It is designed for homelab use with simple setup and no external dependencies beyond the container itself.

Should you self-host tobab?

tobab scores 37/100 on selfhost.directory (how scoring works) and ranks #34 of 40 in Authentication. It has 155 GitHub stars.

There was no stable release in the past 12 months, so check the repository's recent activity before you rely on it.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is MIT-licensed and written mostly in Go.

Its closest alternative on selfhost.directory is keycloak (86/100, 37 564 stars). It scores higher overall, so compare the two before you pick. See tobab vs keycloak side by side.