Configure External Access

Let other people and devices sign in to Oore over HTTPS. Keep Local Only while one operator uses Oore from the backend Mac. Turn on External Access when a second person, or a phone that installs builds, needs to reach the instance.

For what External Access changes and how the two identity modes compare, read How External Access works.

What you need

• The Oore Owner account on a ready macOS backend.
• A protected HTTPS path that browsers can reach, such as a reverse proxy or a Cloudflare Tunnel. Oore does not set up DNS, certificates, proxies, tunnels, or firewalls.
• The exact origin of each browser client you will use, such as https://ci.oore.build for the hosted UI.
• Terminal access to the backend Mac, in case you need to recover.

1. Choose how people sign in

• OIDC with Google, Microsoft Entra ID, Okta, Auth0, or Keycloak. Choose this unless an access proxy already checks identity in your deployment. You can turn it on for a ready Local Only instance.
• Trusted Proxy when an existing authentication proxy verifies people before traffic reaches Oore. It is set when the instance is first initialized and cannot convert a ready instance.

2. Follow the guide for that mode

• Configure External Access (OIDC): set the network, connect the provider, pass the technical checks, and turn it on.
• Configure External Access (Trusted Proxy): initialize the backend behind the proxy.

For the hosted UI behind Cloudflare, follow Connect Cloudflare Tunnel and Access, which uses OIDC.

Verify the result

1. In Settings > General, the External access badge names the sign-in mode instead of Local only, and the button reads Turn off.
2. From a second device or a private window, open the browser client and sign in. Oore opens as the expected user.
3. The backend Mac still answers oore status.

Troubleshooting

Turn on stays unavailable

A setup step or technical check has not passed. Open Technical checks and fix each failed check. The Public URL (HTTPS) must be a non-loopback HTTPS URL, and its origin must be under Allowed frontend origins.

Everyone is signed out after the change

Turning External Access on or off revokes every session. Sign in again through the new mode.

A person signs in at the provider but Oore rejects them

Oore knows only invited or active users. Invite them with the exact email their provider returns.

You are locked out

Use host-authorized recovery on the backend Mac. See oore recovery.

Next step

Invite a team member, then manage roles and project access.