First identify what you are deploying: a standalone marimo server, a Kubernetes-managed notebook, a notebook exported to Cloudflare Workers, or marimohub. These are different deployment paths, and marimohub’s OIDC settings do not configure authentication for every marimo server. For Kubernetes, the documented default is token authentication; for marimohub, configure its OIDC sign-in flow and public HTTPS callback. An exported Cloudflare notebook uses a modifiable Worker script rather than a live-editor reverse-proxy setup.
Choose the authentication path for your deployment
“Self-hosted marimo” can refer to the notebook application itself or to marimohub, a separate platform for managing and running marimo notebooks. Identify which one you operate before applying configuration: their authentication mechanisms are not interchangeable.
| Deployment | Authentication approach documented | HTTPS approach |
|---|---|---|
| Kubernetes-managed notebook | Token authentication is the default; setting auth to "none" disables it. |
Use the ingress or proxy selected for your cluster and follow that platform’s current TLS documentation; the marimo guide does not prescribe a universal proxy configuration. |
| Cloudflare-hosted notebook export | Add authentication logic or endpoints by modifying the generated Worker script as needed. | Use the Cloudflare hosting setup for the exported notebook; this is not a recipe for proxying a live editor. |
| marimohub | Configure its application-native OIDC flow, including an allowed email-domain list. | Use HTTPS for the issuer, public callback, and discovered authorization and logout endpoints. |
References: marimo’s Kubernetes deployment guide, Cloudflare publishing guide, and marimohub documentation.
Keep authentication enabled for Kubernetes deployments
The official Kubernetes guide documents token authentication as the default. It also documents auth: "none" as the way to disable authentication. Do not use that setting on a network-exposed deployment unless you have deliberately placed another protective access boundary in front of it.
#1 Best Overall
The guide does not establish one proxy or ingress configuration for every cluster. Configure public TLS at the ingress or proxy you choose, using that platform’s current instructions, and preserve the intended authentication boundary. Avoid assuming that marimohub’s OIDC variables apply to a Kubernetes-managed standalone notebook.
See the Kubernetes deployment guide for the documented token-authentication behavior and deployment configuration.
Add authentication to a Cloudflare notebook export
For a notebook published as a Cloudflare Worker, use the export path rather than a live-editor proxy recipe. Export the notebook as WebAssembly HTML with the Cloudflare option, then modify the generated index.js Worker to add authentication logic or endpoints appropriate to the application.
This applies to the generated Worker hosting path; it does not describe how to protect a running marimo editor process. Consult the Cloudflare publishing guide for the export workflow.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
Configure OIDC and HTTPS for marimohub
marimohub has its own OIDC configuration. Set the issuer, client ID, client secret, redirect URI, session secret, and allowed email domains. Its callback URL follows this form:
https://<your-host>/api/auth/callback
Register that exact public URL with your identity provider. The issuer, callback, and discovered authorization and logout endpoints must use HTTPS; credentials must not be embedded in those URLs. The allowed email-domain setting is required, and * allows all domains. Prefer a specific domain allowlist when access should be restricted.
Rank #4
If TLS terminates at a proxy, the public hostname and HTTPS scheme presented to users must align with the registered callback. Operationally, this means checking that the application’s externally visible URL is not accidentally treated as an internal HTTP address; otherwise sign-in may not return to the callback registered with the identity provider.
Configure the identity provider and secrets
- Create an OIDC client with your identity provider and set its issuer and client ID in the marimohub deployment configuration.
- Set the client secret and a strong session secret using deployment secret management rather than embedding them in notebook artifacts.
- Set the redirect URI to the exact public HTTPS callback,
https://<your-host>/api/auth/callback, and register that same URI with the identity provider. - Set the required allowed email domains to the domains whose users should be permitted to sign in; use
*only if access from any email domain is intended. - Confirm that the issuer and OIDC authorization and logout endpoints discovered from it are HTTPS URLs and contain no embedded credentials.
marimohub’s documentation names Google, Okta, Auth0, and Microsoft Entra ID among identity providers for OIDC configuration. Provider-specific screens and steps vary, so use the provider’s own current instructions when creating the client. See marimohub’s OIDC documentation.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsKeep deployment secrets out of notebook artifacts
Do not bake connection strings or deployment secrets into notebook images or project environment variables. The marimohub Azure deployment guidance recommends using deployment secret management and also shows Entra ID OIDC configuration. Apply the same separation when managing OIDC client secrets and session secrets: make them available to the deployment through its secret-management mechanism, not as notebook content. See the Azure deployment guidance.
Verify the deployed sign-in and HTTPS path
After configuration, test from outside the host rather than relying only on a local check:
- Open the public address and confirm that it loads over HTTPS without a browser certificate warning.
- For marimohub, sign in and confirm that the identity provider returns the browser to the exact registered callback URL.
- Try an unauthenticated request to a protected route and confirm it does not reveal protected content.
- For Kubernetes, confirm token authentication remains enabled unless a separate protective access boundary is intentionally in place.
These are deployment checks to perform on your own environment; results depend on your chosen proxy, identity provider, and deployment configuration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
