This insight was synthesized by AI from public community discussions. We do not display original user posts or comments verbatim—all content has been rewritten and aggregated. Verify before acting on it.
Auth gateway for self-hosted media with TV QR login
A reverse-proxy-based authentication gateway specifically designed for self-hosted media servers like Jellyfin that provides OIDC/SSO integration, QR-code-based TV device login, and session management. Delivered as both a self-hosted Docker image and a managed SaaS tier, it consolidates the fragmented Authentik+LLDAP+OAuth Proxy stack into one solution while solving the unsolved TV authentication problem.
Why this matters
You run a self-hosted media server for friends and family, but every new app you add creates yet another separate account system. You have invested hours setting up Authentik or LLDAP with LDAP bridges and OAuth proxies, chaining three to five tools together just to get centralized authentication. Despite all this effort, your TV apps still cannot log in through modern auth flows because they lack browsers, forcing users to type passwords with a remote. When you look for solutions, you find that the media server project rejected a complete OIDC contribution because maintainers cannot handle the maintenance burden, leaving you with no timeline for native support. You want one tool that handles SSO, TV device login, and session management without the fragile multi-service stack you currently maintain.
- · Built for Self-hosted enthusiasts and homelab operators running media servers (Jellyfin, Emby, Navidrome) who need centralized authentication across web, mobile, and TV clients, particularly those already invested in identity providers like Authentik or Authelia..
- · Most likely monetization: Freemium: free self-hosted Docker image with basic OIDC proxy; paid SaaS tier ($10/month) for managed relay, multi-app support, and advanced device flows; enterprise tier for organizations.
The Pain · Narrative
You run a self-hosted media server for friends and family, but every new app you add creates yet another separate account system. You have invested hours setting up Authentik or LLDAP with LDAP bridges and OAuth proxies, chaining three to five tools together just to get centralized authentication. Despite all this effort, your TV apps still cannot log in through modern auth flows because they lack browsers, forcing users to type passwords with a remote. When you look for solutions, you find that the media server project rejected a complete OIDC contribution because maintainers cannot handle the maintenance burden, leaving you with no timeline for native support. You want one tool that handles SSO, TV device login, and session management without the fragile multi-service stack you currently maintain.
Score Breakdown
Market Signal
Go-to-Market
Homelab operators running Jellyfin with multiple users who already have Authentik or Authelia set up but struggle with TV client authentication
Approximately 50,000-100,000 power users in self-hosted media communities who run multi-user setups with identity providers
Self-hosted community forums and subreddits where users discuss auth workarounds, with technical blog posts demonstrating the QR-code TV login flow
$8/month for managed SaaS tier with relay and multi-app support
100 Docker image pulls and 10 paying SaaS customers within 30 days of launch, validated through community forum engagement
MVP Scope · 1–2 weeks
- Build core reverse proxy with OIDC provider integration supporting Authentik and generic OAuth2 endpoints
- Implement session token creation and injection for Jellyfin API to enable transparent auth passthrough
- Develop QR-code generation endpoint and companion mobile-optimized web page for scanning and completing device authorization
- Create Docker Compose deployment template with documentation for self-hosted installation alongside Jellyfin
- Set up basic analytics dashboard for session creation, active users, and auth success/failure rates
- Add short-lived numeric session token entry flow for TV clients that cannot scan QR codes, with configurable token length and TTL
- Implement LDAP bridge mode for compatibility with apps and plugins that only support LDAP authentication
- Create integration profile for a second media app (Navidrome or Audiobookshelf) to validate multi-app architecture
- Build SaaS control plane with user registration, proxy configuration UI, and Stripe billing integration
- Publish technical blog post and demo video showing QR-code TV login flow, distribute in self-hosted communities for feedback
Differentiation
Why This Might Fail
Self-rebuttal — the most important trust signal
- 1Self-hosted community strongly prefers free open-source solutions and may fork or replicate the core functionality rather than paying for the SaaS tier
- 2TV client applications may not cooperate with proxy-injected authentication, requiring app-specific hacks that break with every client update and making the QR flow unreliable on some platforms
- 3Upstream media server projects may accelerate native OIDC development in response to community pressure, eliminating the primary use case before the product achieves sustainable traction
Evidence Summary
How AI synthesized this insight — no verbatim quotes
Multiple users across the discussion describe running three or more identity services in combination to achieve centralized auth, with one user explicitly listing LLDAP, Pocket ID, and OAuth Proxy as their stack. Six separate mentions focus on the inability of TV clients to use modern auth flows, with users requesting QR-code-based device login. Nine mentions address the lack of native OIDC in self-hosted media servers, and maintainers confirmed they rejected a complete PR due to maintenance concerns. Three users reported reliability issues with existing auth plugins including configuration-wiping bugs. This convergence of pain across auth, device login, and plugin reliability signals a well-defined market gap.
Action Plan
Validate this opportunity before writing code
Recommended Next Step
Build
Strong demand signals detected. Real pain, real willingness to pay — start building an MVP.
Landing Page Copy Kit
Ready-to-paste copy based on real Reddit community language — no editing required
Headline
Auth gateway for self-hosted media with TV QR login
Sub-headline
A reverse-proxy-based authentication gateway specifically designed for self-hosted media servers like Jellyfin that provides OIDC/SSO integration, QR-code-based TV device login, and session management. Delivered as both a self-hosted Docker image and a managed SaaS tier, it consolidates the fragmented Authentik+LLDAP+OAuth Proxy stack into one solution while solving the unsolved TV authentication problem.
Who It's For
For Self-hosted enthusiasts and homelab operators running media servers (Jellyfin, Emby, Navidrome) who need centralized authentication across web, mobile, and TV clients, particularly those already invested in identity providers like Authentik or Authelia.
Feature List
✓ OIDC/OAuth2 reverse proxy authentication for media servers without native SSO ✓ QR-code-based device authorization flow for TV and embedded clients ✓ Short-lived numeric session token entry for devices without QR scanning capability ✓ Pre-built integration profiles for Jellyfin, Emby, Navidrome, and other popular self-hosted media apps ✓ Compatibility with existing identity providers (Authentik, Keycloak, Authelia, Google, GitHub) ✓ LDAP bridge mode for apps with only LDAP support ✓ Optional managed relay service for remote access without port forwarding
Where to Validate
Share your landing page in r/r/selfhosted — that's exactly where these pain points were discovered.
Sign up to unlock full deep analysis
GTM, MVP scope, why-it-might-fail, ActionPlan Copy Kit. Free signup grants 10 detail views/month.
Other opportunities in the same theme
Auto-clustered by AI from related discussions