Add Google, GitHub or OIDC Sign-In to Your Self-Hosted Dashboard, and Keep It Safe

Description and use

Implementing OAuth/OIDC in the self‑hosted Levelrail dashboard with domain‑restricted sign‑ups, automatic read‑only user creation, role‑based invites, device‑code CLI login, and audit logging.

Problem

Implement secure OAuth/OIDC sign‑in for a self‑hosted dashboard while preventing unauthorized access and account takeover.

Outcome

OAuth/OIDC integration added with domain‑restricted sign‑ups, read‑only default users, role‑based invites, device‑code CLI login, and audit logging, enhancing security while maintaining usability.

Workflow

• Register an OAuth app at the provider and set the redirect URI to /api/v1/auth/oauth/PROVIDER/callback
• Enable the provider in Levelrail Settings with client ID, secret, and issuer URL for OIDC
• Restrict sign‑ups by allowed email domain using levelrail-cli settings oauth set
• Understand sign‑in outcomes: linked account, new domain‑allowed user (read‑only), domain‑not‑allowed (403), email conflict (refused)
• Invite teammates via levelrail-cli invites create with role or abilities, ensuring privilege checks
• Enable CLI login with device‑code flow using levelrail-cli auth login --device

Evidence

Register an OAuth application. You will need to give it a redirect URI, which is the callback path on your dashboard: /api/v1/auth/oauth/PROVIDER/callback

Source

Each provider has an allowed email domain setting. With it set, a new signup outside that domain gets refused.

Source

The sign‑in logic has four outcomes, and the choices behind them are deliberate.

Source