# Support reverse proxy authentication

**URL:** <https://discourse.pi-hole.net/t/support-reverse-proxy-authentication/85780>\
**Category:** Feature Requests\
**Created:** [April 17, 2026, 7:01am UTC](https://discourse.pi-hole.net/t/support-reverse-proxy-authentication/85780 "2026-04-17T07:01:03Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![piejanssens](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/piejanssens/32/55275_2.png) [@piejanssens](https://discourse.pi-hole.net/u/piejanssens)\
**Post date:** [April 17, 2026, 7:01am UTC](https://discourse.pi-hole.net/t/support-reverse-proxy-authentication/85780/1 "2026-04-17T07:01:03Z")

</div>

**Problem:**

Pihole’s authentication is based on a single password that is used for logging in into the FTL webserver and used for authentication in API requests.

- There is no option to enable basic auth, which would allow the reverse proxy to add the Authorization header in the requests routed to pihole
- There is no support for Remote-User to forward an externally authenticated user ID
- Disabling the password by setting `FTLCONF_webserver_api_password=’’` allows authentication to be handled externally and not be faced with the Pi-hole login screen, but it also exposes the API within the network as it can now be reached with password ` `.

**Request:**

- Option A (better, allows logging by name): Provide option to configure a request header (e.g. ‘Remote-User’) and its value(s) which allows the admin to setup one or more user ID’s that need to be considered authenticated when the header and known value is present in a request to the webserver.
- Option B: introduce config `FTLCONF_webserver_external_login`, defaulted `false`, when `true` any request to `/admin` is considered authenticated.
- Option C: define a specific header (e.g. `X-FTL-Password`) and implement a mechanism to use this forwarded and authenticate the session automatically. (This is only sent from the reverse proxy server to the application, not exposed externally.)
- With either option in place, the `FTLCONF_webserver_api_password` is be kept as the [credential to request an API access token](https://docs.pi-hole.net/api/auth/).

---

<div class="post-metadata">

**Author:** ![nero355](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/nero355/32/54774_2.png) [@nero355](https://discourse.pi-hole.net/u/nero355)\
**Post date:** [April 17, 2026, 4:55pm UTC](https://discourse.pi-hole.net/t/support-reverse-proxy-authentication/85780/2 "2026-04-17T16:55:31Z")

</div>

> [@piejanssens](#):
>
> Disabling the password by setting `FTLCONF_webserver_api_password=’’` allows authentication to be handled externally and not be faced with the Pi-hole login screen, but it also exposes the API within the network as it can now be reached with password ` `.

According to : [civetweb/docs/UserManual.md at master · civetweb/civetweb · GitHub](https://github.com/civetweb/civetweb/blob/master/docs/UserManual.md)

> CivetWeb can also be used to modify .htpasswd passwords files

So you can probably hide the API by adding such a file to the root of the API directory 🙂

---

<div class="post-metadata">

**Author:** ![Joachim](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/j/a87d85/32.png) [@Joachim](https://discourse.pi-hole.net/u/Joachim)\
**Post date:** [May 12, 2026, 7:28pm UTC](https://discourse.pi-hole.net/t/support-reverse-proxy-authentication/85780/3 "2026-05-12T19:28:47Z")

</div>

I want to support the problem statement. I would like to replace the single user/single password with OIDC. I don´t really care, whether pi-hole validates tokens itself or whether I use nginx to validate and enforce authentication.

I am also using nebula-sync to replicate configuration between multiple pi-holes, just disabling authentication in pi-hole and just using the nginx doesn´t work for me.

I definitely would prefer a solution that allows to log user names (and allowing me to use "nebula" or the like for replication).

---

<div class="post-metadata">

**Author:** ![piejanssens](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/piejanssens/32/55275_2.png) [@piejanssens](https://discourse.pi-hole.net/u/piejanssens)\
**Post date:** [May 12, 2026, 8:06pm UTC](https://discourse.pi-hole.net/t/support-reverse-proxy-authentication/85780/4 "2026-05-12T20:06:43Z")

</div>

Thanks. I suggest you upvote this feature request. 😉

---

<div class="post-metadata">

**Author:** ![Browndw4](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/browndw4/32/55998_2.png) [@Browndw4](https://discourse.pi-hole.net/u/Browndw4)\
**Post date:** [July 20, 2026, 9:18pm UTC](https://discourse.pi-hole.net/t/support-reverse-proxy-authentication/85780/5 "2026-07-20T21:18:21Z")

</div>

I also support this feature request.

Even something as simple as just separating the dashboard password from the API tokens would be sufficient.

I access my dashboard via an external reverse proxy. Would prefer to have the dashboard accessed via my SSO solution while having the API access secured by the standard tokens all plugins expect.

---

<div class="post-metadata">

**Author:** ![deHakkelaar](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dehakkelaar/32/674_2.png) [@deHakkelaar](https://discourse.pi-hole.net/u/deHakkelaar)\
**Post date:** [July 21, 2026, 12:04pm UTC](https://discourse.pi-hole.net/t/support-reverse-proxy-authentication/85780/6 "2026-07-21T12:04:00Z")

</div>

You guys do know how the FR voting system works?

You have to actually vote for it with the arrow up button next to the FR subject.  
Currently this FR has zero votes.

---

<div class="post-metadata">

**Author:** ![paifre](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/paifre/32/56387_2.png) [@paifre](https://discourse.pi-hole.net/u/paifre)\
**Post date:** [September 26, 2026, 7:10pm UTC](https://discourse.pi-hole.net/t/support-reverse-proxy-authentication/85780/7 "2026-09-26T19:10:33Z")

</div>

Fully supporting this request. I’m using an SSO solution linked to my reverse proxy

Would be great to be able to connect with pihole

---

<div class="post-metadata">

**Author:** ![Gabriel403](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/gabriel403/32/56422_2.png) [@Gabriel403](https://discourse.pi-hole.net/u/Gabriel403)\
**Post date:** [October 4, 2026, 12:35pm UTC](https://discourse.pi-hole.net/t/support-reverse-proxy-authentication/85780/8 "2026-10-04T12:35:55Z")

</div>

I'd also like this, can't vote for it yet though

---

<div class="post-metadata">

**Author:** ![Kornelius777](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/kornelius777/32/33981_2.png) [@Kornelius777](https://discourse.pi-hole.net/u/Kornelius777)\
**Post date:** [October 5, 2026, 9:33am UTC](https://discourse.pi-hole.net/t/support-reverse-proxy-authentication/85780/9 "2026-10-05T09:33:35Z")

</div>

I'd like to upvote as well.

OIDC via authentik would be my favorite choice!