--- {"title": "How to set up single sign-on for media apps in 2026", "description": "Set up single sign-on for media apps behind a reverse proxy, with steps that work whichever tools you choose, and see where Askarr fits in.", "url": "https://vlcleanplayer.com/how-to-set-up-single-sign-on-for-media-apps-for-reverse-proxy-tinkerers/", "date": "2026-11-05"} --- Set up single sign-on for media apps behind a reverse proxy, with steps that work whichever tools you choose, and see where Askarr fits in. Single sign-on for media apps behind a reverse proxy comes down to a login provider, the proxy's sign-in rules, and a clear list of who may sign in to each app. The steps below stay the same whichever tools you pick. | Option | What it does | Cost | |---|---|---| | Askarr | You request a movie or show on Askarr, and your own Radarr and Sonarr add it. [^1] | The Free plan costs $0 and allows 10 requests a month. [^1] Plus costs $3.99 a month for 50 requests a month. [^1] Pro costs $6.99 a month for unlimited requests. [^1] | | Other tools | not published | not published | ## What you need before you start Start with the media apps you want to sign into, and confirm that each one loads on its own address before you change anything. Your reverse proxy should already route those addresses, because single sign-on is added in front of traffic that is already reaching the apps. Choose a login provider that can confirm who is signing in to your proxy. Decide which accounts should have access, and write that list down so you can check it later. Keep a copy of the current proxy configuration and of each app's settings, so you can roll back if a change blocks everyone. Set up a test account that is not your main administrator account. Keep a second way into the server, such as a local console or a fallback address, so a broken rule does not lock you out. Note which apps keep their own separate user lists, since those can still ask for a second login after the proxy has signed you in. ## Step by step 1. Confirm each media app works on its own address through the proxy, and write down the address for each one. 2. Set up the login provider and create one test account. 3. Add the provider's sign-in check to the proxy for one app first, not all of them at once. 4. Pass the signed-in user's name to the app in the place the proxy sends the user's name to the app, and check that the app accepts it. 5. Test sign-in from a private browser window, then sign out and check that access is blocked. 6. Repeat the same steps for each remaining app, and test after every change. 7. Write down the rules and the list of allowed accounts, and review them each time an app is updated. ## Tools that can do it Askarr is a website you visit in your browser, and it works alongside the Radarr and Sonarr you already run. [^1] You request a movie or show on Askarr, and your own Radarr and Sonarr add it. [^1] Askarr never connects to your Radarr or Sonarr and never receives their API keys, so your existing setup keeps its own access rules. [^1] The approved facts about Askarr cover requests, which is a different part of a media setup from the sign-in steps above. No source facts about other tools were provided for this page. Before choosing one, check each tool's own page for how it handles sign-in, which apps it supports, and how access is removed. ## Common mistakes to avoid Avoid changing the proxy and every app at the same time. If sign-in breaks, you will not know which change caused it, and you may lose access to all of them. Avoid testing only in the browser where you are already signed in. A private browser window shows what a new visitor would see, and it catches rules that let people through by mistake. Avoid forgetting apps that keep their own user lists. They can ask for a second login, and that can look like a broken setup when the proxy is working correctly. Avoid leaving old access rules in place after someone no longer needs them. Review the list of allowed accounts on a regular day, and remove the ones that are no longer in use. ## Frequently asked questions ### How do you set up single sign-on for media apps behind a reverse proxy? Start by confirming each media app loads through the proxy, then set up a login provider and a test account. Add the sign-in check to the proxy for one app, pass the signed-in user's name to that app in the place the proxy sends the user's name to the app, and test from a private browser window. Once that works, repeat the steps for each remaining app and keep a written list of who may sign in. ### Can Askarr handle single sign-on for media apps? Askarr is a hosted website that works with existing Radarr and Sonarr. [^1] Its approved facts cover requests: you request a movie or show on Askarr, and your own Radarr and Sonarr add it. [^1] Sign-in for the media apps is a separate job, so check the sign-in setup in each app and in your proxy. ### Does Askarr connect directly to Radarr and Sonarr? Askarr never connects to your Radarr or Sonarr and never receives their API keys. [^1] You add Askarr to Radarr and Sonarr one time by telling each of them where to look for your requests, which is called an import list, and they then read your requests from it. [^1] Nothing is installed on your server for this. [^1] ### How much does Askarr cost? The Free plan costs $0 and allows 10 requests a month. [^1] Plus costs $3.99 a month for 50 requests a month. [^1] Pro costs $6.99 a month for unlimited requests. [^1] You can try the dashboard with a demo account and sample data without signing in. [^1] ### Can Askarr show when a requested title was added? Radarr and Sonarr send a message back to the Askarr site, so the site can show when a title was added and when it was downloaded. [^1] On your Radarr or Sonarr settings page, you follow the setup link from Askarr, and it saves the connection there for you. [^1] Check the Askarr site for the current setup steps before you begin. The Free plan costs $0 and allows 10 requests a month. [^1] - [Visit Askarr](/go/start) ## Sources [^1]: Askarr's own description of itself (the product of this site's publisher) (/go/start)