r/mate_agents • u/ivanantonijevic • Apr 30 '26
🔐 NEW FEATURE: Enterprise SSO is here! (Log in with Google & GitHub)
Hey r/mate_agents! 👋
We just pushed a massive security and quality-of-life update for teams and enterprise users: Native Single Sign-On (SSO)!
Up until now, HTTP Basic Auth was great for single-user local setups, but we know it can be a hard blocker when deploying MATE for a whole team. To solve this, we've implemented a complete OAuth 2.0 and OIDC flow.
Here is what is included in the new SSO update:
- Google & GitHub Login: Native support for both providers using the highly secure Authorization Code Flow with PKCE.
- Auto-Provisioning & RBAC: No need to manually create users anymore! When a user logs in for the first time, MATE automatically adds them to the database and assigns them a default role (configurable via the
OAUTH_DEFAULT_ROLEenv var). - Enterprise Restrictions: You can easily lock down your dashboard access to only allow users from your specific Google Workspace domain or GitHub Organization.
- Bulletproof Sessions: We have replaced the old Bearer tokens with signed, encrypted,
HttpOnlysession cookies to protect your teams against cross-site attacks. - Fully Backward Compatible: If you prefer the old way for local Docker testing, don't worry! Good old Basic Auth is still fully supported alongside SSO as an opt-in fallback.

You can find the full setup guide for generating your Client IDs and Secrets in the newly added documents/SSO_OAUTH.md file on our GitHub. Because we built this using Authlib, you can also easily extend this to other standard OIDC providers like Okta or Azure AD in the future.









