Deploy your Spring Boot apps to Koyeb with zero-config. No credit card required.

Boot Spring Apps on Koyeb

Deploy and configure your Spring Boot application with the customizable and lightweight Spring Authorization Server on Koyeb.

Using Spring Authorization Server as an Auth Solution on Koyeb


## Introduction

[Authorizer](https://authorizer.dev/) is an open-source authentication and authorization platform for applications. It supports a number of different authentication methods including basic authentication, magic links, social logins, and multi-factor authentication. Using Authorizer, you can configure a secure authentication layer that can be used across various applications and servers, helping you provide account-based services to your applications without the headache.

In this guide, we will go over how to deploy and configure an Authorizer instance on [Koyeb](/) to provide authorization and authentication services for your other applications and services.

You can deploy and configure Authorizer as configured in this guide using the [Deploy to Koyeb](/docs/build-and-deploy/deploy-to-koyeb-button) button below:

[![Deploy to Koyeb](/static/images/deploy/button.svg)](https://app.koyeb.com/deploy?name=authorizer&type=docker&image=docker.io/lakhansamani/authorizer&env[PORT]=8000&env[DATABASE_TYPE]=postgres&env[DATABASE_URL]=CHANGE_ME&ports=8000;http;/)

**Note:** Remember to replace the value of the `DATABASE_URL` environment variable with the connection URL for your own PostgreSQL database.

## Requirements

To follow along with this guide, you will need to create accounts with the following services. Each of these services offers a free tier that you can use to get started:

- **[Koyeb](https://app.koyeb.com/):** We will use Koyeb to deploy, run, and scale our Authorizer instance.
- **[Neon](/docs/integrations/databases/neon):** We will use Neon to provision a PostgreSQL database to store and manage Authorizer's data including user information and authentication providers.
- **[Mailgun](https://www.mailgun.com/):** We will use Mailgun to send messages to users for verification, two factor authentication, and other authentication-related transactional emails.

## Steps

This guide will cover how to deploy Authorizer to Koyeb with the following steps:

1. [Create a PostgreSQL database with Neon](#create-a-postgre-sql-database-with-neon)
2. [Set up the Mailgun SMTP service](#set-up-the-mailgun-smtp-service)
3. [Deploy Authorizer to Koyeb](#deploy-authorizer-to-koyeb)
4. [Configure Authorizer](#configure-authorizer)
   - [Set up the admin account](#set-up-the-admin-account)
   - [Configure SMTP for email](#configure-smtp-for-email)
   - [Configure Authorizer features](#configure-authorizer-features)
   - [Test the sign up and authentication workflow](#test-the-sign-up-and-authentication-workflow)

## Create a PostgreSQL database with Neon

The Authorizer application stores its configuration data in a database.

To make it simpler to scale the application as well as ensure the availability of the data across restarts, we'll configure Authorizer to use an external database. Specifically, we will deploy Authorizer to a PostgreSQL database provisioned using Neon since they offer a free tier that is suitable for our purposes.

To create a new PostgreSQL database, log into your [Neon account](https://console.neon.tech/sign_in). In the Neon console, follow these steps to create a new PostgreSQL database:

1. In the **Projects** section, click the **Create a project** link on the bottom of the page.
2. Choose a name for your PostgreSQL database. We will use `authorizer` for this guide.
3. Leave the version to the default selection (15 at the time of writing).
4. Select the region to deploy your database. In this guide, we will select "Europe (Frankfurt)" to demonstrate deploying resources in Europe, but you should choose the region closest to your users.
5. Click the **Create project** button to begin provisioning your new database.

The following screen will show the connection details for your new database. Click on the copy icon associated with the `psql` connection string to copy it and save it to a safe place for later reference. We will use this value when we configure Authorizer so that it can connect to and authenticate with the database.

## Set up the Mailgun SMTP service

Next, you need to copy the SMTP information for your Mailgun account. Authorizer uses email to verify user accounts, send magic sign-in links, or provide additional security through multi-factor authentication.

To begin, log into your [Mailgun account](https://login.mailgun.com/login/). In the side navigation pane, open the **Sending** menu. Next, click the **Overview** sub-menu item.

Mailgun offers sandbox domains to test its functionality. These are useful, but restricted to sending emails only to previously authorised email addresses. We can use this to test the mail delivery with Authorizer for free. On the right sidebar of the Overview page, enter the email address you want to send test emails to in **email address** input field of the **Authorized Recipients** section and click the **Save Recipient** button.

Mailgun will send a verification email to the provided address. In the verification email, click the **I Agree** button to complete the authorisation process. If you refresh the page in Mailgun, you see that the target email address is now marked as verified.

From this same page, click the **Select** box associated with "SMTP" to see the information you need to send email using your Mailgun account. The information related to using SMTP with your Mailgun account will be displayed. Copy and save the following information:

| Mailgun SMTP info | Authorizer environment variable    | Example                                                          |
| ----------------- | ---------------------------------- | ---------------------------------------------------------------- |
| SMTP hostname     | `SMTP_HOST`                        | `smtp.mailgun.org`                                               |
| Port              | `SMTP_PORT`                        | 587                                                              |
| Username          | `SMTP_USERNAME` and `SENDER_EMAIL` | `postmaster@sandboxbac59f0e6dac45cdab38e53aee4e1363.mailgun.org` |
| Password          | `SMTP_PASSWORD`                    | `e627704d99111f00c7aedf3805961383-262b123e-66b6979f`             |

You will need to provide this information either as environment variables when deploying Authorizer or in the web-based administration page after the service is up and running.

## Deploy Authorizer to Koyeb

With the database connection string in hand, you can now deploy an Authorizer instance to Koyeb.

Start by logging into your [Koyeb account](https://app.koyeb.com/auth/signin). Follow these steps to deploy the default [Authorizer container image](https://hub.docker.com/r/lakhansamani/authorizer) to the platform:

1. On the **Overview** tab of the [Koyeb console](https://app.koyeb.com/), click **Create Web Service**.
2. Select **Docker** as your deployment method.
3. Set the **Docker image** to `docker.io/lakhansamani/authorizer`. Optionally, append an [image tag](https://hub.docker.com/r/lakhansamani/authorizer/tags) if you'd like to deploy a specific version.
4. In the **Environment variables** section, click the **Add variable** button to add the following variables and values:
   - `DATABASE_TYPE`: Set to `postgres`.
   - `DATABASE_URL`: Set to the connection URI you copied from Neon.
5. (Optional) If you'd like to configure your SMTP settings now, you can do so by setting the following additional variables:
   - `SMTP_HOST`: The name of the SMTP host (`smtp.mailgun.org`).
   - `SMTP_PORT`: The port of the SMTP service (587).
   - `SMTP_USERNAME`: The username to authenticate to your Mailgun account. This starts with `postmaster@` and ends in `.mailgun.org`
   - `SMTP_PASSWORD`: The password to authenticate to your Mailgun account.
   - `SENDER_EMAIL`: The sending email address. This should match the value set in the `SMTP_USERNAME`.
6. Choose a name for your App and Service and click **Deploy**.

Koyeb will pull the Authorizer container image from Docker Hub and use it to provision a new container. The Authorizer process will start up, connect to and initialize the database, and begin listening on the port specified in the configuration.

## Configure Authorizer

Once Authorizer is up and running, you can visit your Koyeb Service's subdomain (you can find this on your Service's page) to connect. It will have the following format:

```
https://<YOUR_APP_NAME>-<KOYEB_ORG_NAME>.koyeb.app
```

### Set up the admin account

When you visit Authorizer's URL, you will be redirected to the admin login page.

The first time you visit, you'll be asked to set an administrative password:

![Authorizer set admin password](/static/images/tutorials/authorizer/set_admin_password.png)

Choose a secure password and the click **Sign up** to continue.

You will be taken to the administration dashboard:

![Authorizer admin dashboard](/static/images/tutorials/authorizer/admin_dashboard.png)

From here, you can modify settings and continue configuring your instance.

### Configure SMTP for email

In the **Environment** section on the left side menu, click **Email Configurations** to see the settings currently configured for your SMTP service.

If you deployed Authorizer with the SMTP environment variables set, you should see those settings reflected in the form on this page:

![Authorizer email settings](/static/images/tutorials/authorizer/email_settings.png)

If you skipped adding your SMTP settings during the initial deployment, you can set those now. You should set the following fields:

- SMTP Host: The name of the SMTP host (`smtp.mailgun.org`).
- SMTP Port: The port of the SMTP service (587).
- SMTP Username: The username to authenticate to your Mailgun account. This starts with `postmaster@` and ends in `.mailgun.org`
- SMTP Password: The password to authenticate to your Mailgun account.
- From Email: The sending email address. This should match the value set in the "SMTP Username" field.

Click **Save** when you are finished to start using your new email configuration.

### Configure Authorizer features

Next, click the **Features** item in the **Environment** section of the left side menu.

Here, you can select the features that are enabled in your Authorizer instance. Depending on how you initially deployed your service, certain features may be enabled or disabled by default. All email-related features require valid SMTP settings in order to function correctly.

For our testing, we will enable the following features. We will toggle all other features off:

- Login Page
- Email Verification
- Basic Authentication
- Sign Up
- Strong Password
- Use Secure App Cookie
- Use Secure Admin Cookie

![Authorizer feature selection](/static/images/tutorials/authorizer/feature_selection.png)

Click **Save** when you are finished to modify the current configuration.

### Test the sign up and authentication workflow

To test the new settings, visit the built-in authentication page by appending `/app` to the end of Authenticator's base URL. It should look something like this:

```
https://<YOUR_APP_NAME>-<KOYEB_ORG_NAME>.koyeb.app/app
```

Assuming you've enabled only the features we outlined above, you should see a fairly conventional login page with an email field, a password field, a log in button, as well as links to sign up or to recover your account if you forgot your password:

![Authorizer initial login page](/static/images/tutorials/authorizer/initial_login_page.png)

Since we do not yet have a user account, click the **Sign up** link at the bottom of the page. You will be taken to an account creation page:

![Authorizer account creation page](/static/images/tutorials/authorizer/account_creation_page.png)

Create an account to test the authentication settings by inputting your email address and setting and confirming a secure password.

**Note:** Be sure to use the same email address you authorized in your Mailgun account. Your email will not be delivered otherwise.

Click **Sign up** when you are finished. Authorizer will show you a message indicating that it has sent an email to the provided address to confirm the registration:

![Authorizer verification sent](/static/images/tutorials/authorizer/verification.png)

Check the associated email address (be sure to also check the spam folder since we are sending from an untrustworthy sandbox domain) and click **Confirm Email** in email you receive to activate your account.

Revisit the login page to sign in with your new account. Fill in your email address and password and click **Log In**.

Upon successfully authenticating, you will see a short message confirming that the authentication was successful:

![Authorizer authentication successful](/static/images/tutorials/authorizer/authentication_successful.png)

This verifies that Authorizer is able to complete the sign up and login flows successfully. You can use these same flows with your application using one of the [SDKs provided by Authorizer](https://docs.authorizer.dev/getting-started#integrating-into-your-website).

## Conclusion

In this guide, we installed and configured the Authorizer authentication and authorization framework on Koyeb. We provisioned a PostgreSQL database with Neon to store the configuration used by the application and set up Mailgun to handle mail delivery for account-related events. We then deployed Authorizer and configured it to handle account lifecycle management like user sign ups, verification, logins and more.

By exploring the Authorizer administration interface, you can learn about the different features it offers and the integrations it supports. You can connect with social media networks to allow users to authenticate with their existing accounts through OAuth, set up webhooks to listen to authorization events to integrate deeply with your applications, and configure customized email templates to add your own design elements to account messaging. Visit the [Authorizer documentation](https://docs.authorizer.dev/) to learn more about what is possible and how to make it happen.


This tutorial demonstrates how to deploy and configure Authorizer, an authentication and authorization framework to Koyeb.

Deploy Authorizer to Handle User Authentication on Koyeb


## Introduction

OAuth2 Proxy is a reverse proxy and static file server that provides authentication using third-party providers like Google, GitHub, and others for validating accounts by email, domain, or group.

Oauth2 Proxy is useful when you want:

- One or more of your applications to be accessible only by authenticated users, for instance, users using a specific domain, emails whitelisting, and more
- To rely on a third-party provider to handle the authentication process (Google, GitHub, etc.)
- To keep a clear separation between the authentication service and the rest of your applications

In this guide, we will explain how to deploy OAuth2 Proxy on Koyeb to secure access to a sample application.
We will configure OAuth2 Proxy to use Google as a provider for the authentication. If you are interested in using other providers, you can find the list of supported providers on the [OAuth2 documentation](https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider).

For this tutorial, we will make use of the Koyeb [service mesh and discovery](/docs/reference/service-mesh-and-discovery) and will deploy:

- The OAuth2 Proxy service using the official Docker image and expose it publicly to act as our authentication layer and gateway access our sample application
- A sample application accessible only via the Koyeb [service mesh](/blog/service-mesh-and-microservices-improving-network-management-and-observability) and accessible to authenticated users via OAuth2 Proxy

Below is the diagram of what our deployment will look like:

![OAuth2 proxy deployment on Koyeb](/static/images/tutorials/oauth2-proxy-diagram.svg)

## Requirements

To successfully follow and complete this tutorial, you need:

- A [Koyeb account](https://app.koyeb.com) to deploy and run
- A [GitHub account](https://github.com/) to deploy the sample application

## Steps

To successfully follow this guide, you need to follow these steps:

1. [Create and configure a new Google OAuth application](#create-and-configure-a-new-google-oauth-application)
2. [Deploy and configure OAuth2 Proxy on Koyeb](#deploy-and-configure-oauth2-proxy-on-koyeb)
3. [Deploy a private sample application on Koyeb](#deploy-a-private-sample-application-on-koyeb)
4. [Validate the setup](#validate-the-setup)

## Deploy a private sample application on Koyeb

First, get started by deploying the sample application that the OAuth2 Proxy will serve once a user is authenticated.
In this guide, we will deploy the Koyeb ExpressJS example application available on the following [GitHub repository](https://github.com/koyeb/example-expressjs).

Deploy it inside a new Koyeb App, clicking the **Deploy to Koyeb** button in the readme.
You land on the pre-filled App creation page to deploy the application.

In the **Exposed ports** section, disable the **Public** exposure of the service by clicking the switch.

Change the App name to **oauth2-proxy-on-koyeb** and click **Deploy**

Our Koyeb App is created, and our sample application is being deployed. We can now move to the next section.

## Create and configure a new Google OAuth application

Before deploying the OAuth Proxy service, we need to create a new Google OAuth application we will use to authenticate our users.

Go to https://console.developers.google.com/project and create a new project that will own our application by clicking **New project** on the project dropdown menu in the navigation bar.
Once your project is created, in the search bar, type **OAuth consent screen** and press **Enter**.

You land on the **OAuth consent screen** creation page.

1. Select **External** as User type
2. Fill in the **App information** form with your app's name, logo, scopes, test users, etc.

Once the configuration is completed, click the **Save** button.

Then, in the search bar, type **Credentials** and press **Enter** to create a new OAuth2 client. On the **Credentials** page, click the **Create credentials** button and select **OAuth client ID**.

1. Select **Web application** as the application type
2. Name your OAuth 2.0 client, for example, **Koyeb OAuth2 client**
3. In the **Authorized redirect URIs** click **Add URI** and set the URI to ` https://<yourApp>-<yourOrg>.koyeb.app/oauth2/callback` where `<yourApp>` is your Koyeb App name and `<yourOrg>` your Koyeb organization name

Click the **Create** button, your OAuth client **ID** and **Secret** appear. You can also download them as a JSON file. Save them in a safe place. We will need them in a future step.

Our application is now ready and will allow us to obtain limited access to Google user accounts by delegating user authentication to Google.

## Deploy and configure OAuth2 Proxy on Koyeb

We are now ready to deploy the OAuth2 Proxy service on Koyeb. Go to the **Apps** tab of the [Koyeb control panel](https://app.koyeb.com) and select the App you previously created.

On the chosen App page, click the **Create Service** button to deploy the OAuth2 Proxy service:

1. Select **Docker** as the deployment method.
2. In the **Docker image** field, enter `quay.io/oauth2-proxy/oauth2-proxy`.
3. In the **Environment variables** section, create the following environment variables:

- `OAUTH2_PROXY_COOKIE_SECRET`: with a seed string for secure cookie as value. You can create the following shell command to generate once: `dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 | tr -d -- '\n' | tr -- '+/' '-_'; echo`
- `OAUTH2_PROXY_CLIENT_ID`: with Google Oauth2 client ID you previously created as value
- `OAUTH2_PROXY_CLIENT_SECRET`: with Google Oauth2 client Secret you previously created as value
- `OAUTH2_PROXY_PROVIDER`: with the Oauth provider name as value, here `google`
- `OAUTH2_PROXY_EMAIL_DOMAINS`: with the authenticate emails domains as value, here `*`
- `OAUTH2_PROXY_HTTP_ADDRESS`: with `0.0.0.0:8080` to ensure the OAuth2 Proxy is listening on all interfaces
- `OAUTH2_PROXY_UPSTREAMS`: with the private domain of the Koyeb Service you want to restrict access, example: `http://<myService>.<myApp>.koyeb:3000`

4. Click **Deploy**.

The Oauth Proxy service is being deployed and will be up and running in a few seconds.

## Validate the setup

With the OAuth2 Proxy deployed, we are now ready to test the authentication flow.

In your browser, open your Koyeb App URL of form `https://<yourApp>-<yourOrg>.koyeb.app/`.

You land the OAuth2 Proxy landing page, where you can authenticate with your Google account.

Click the **Sign in with Google** button and select the Google account you want to use to authenticate.
Once the authentication has succeeded, the Oauth2 Proxy will proxy requests to your private sample application.

## Conclusion

In this guide, we demonstrate how OAuth Proxy helps to delegate user authentication to a third-party provider and secure applications without any code changes in your existing application.

We took advantage of the Koyeb Mesh and discovery to make our OAuth2 Proxy and the sample application services communicate effortlessly and securely.

OAuth2 Proxy provides many options you can use to fine-tune the authentication flow and more. You can learn more about what you can achieve by reading the configuration options available in the [documentation](https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/overview).


This guide explains how to deploy OAuth2 Proxy to secure and add authentication to all your services on the Koyeb serverless platform.

Add Authentication to your Apps using OAuth2 Proxy

This tutorial showcases how to build a REST API with Flask and a Fauna database and deploy it on Koyeb serverless platform. It also explains how to add authentication to a REST API.

How to Deploy a REST API with Flask, Fauna, and Authentication on Koyeb

This guide showcases how to add authentication to a Rails application by using Devise and deploy it into production on Koyeb Serverless Platform.

Authentication

Using Spring Authorization Server as an Auth Solution on Koyeb

Deploy Authorizer to Handle User Authentication on Koyeb

Add Authentication to your Apps using OAuth2 Proxy

How to Deploy a REST API with Flask, Fauna, and Authentication on Koyeb

How to Deploy a Rails Application and Add Authentication using Devise