The number one rule for open-source, self-hosted apps:
Have OIDC.
If you're running a tool with 15–20 employees, authentication quickly becomes more than just “can this person log in?”
You need a central identity provider to control who has access, what happens when someone joins or leaves the company, and how permissions are managed across your stack. With OIDC, employees can use their existing Google Workspace, Microsoft Entra ID, Authentik, Keycloak, etc. identity instead of creating another account and password specifically for Macro.
More importantly, when an employee leaves, disabling their company account can immediately revoke their access instead of relying on an admin to remember to delete their account from every self-hosted application.
Anti-example:
- Plane is a great open-source task management tool (a competitor to you), but the lack of OIDC/SSO in its Community version has been a recurring criticism from teams wanting to deploy it internally.
- [SSO Tax](https://ssotax.org/) maintains a whole “wall of shame” for products that either don't support SSO or put it behind an expensive paywall.
Macro is especially well-positioned for this. You're building an entire company operating system - email, chat, docs, tasks, CRM, agents, etc. This is definitely something you'll need, since permissions are already a core part of the architecture.
Please consider adding OIDC as a first-class authentication option for self-hosted Macro.
It would make Macro dramatically easier to deploy in real organizations without forcing every team to build their own authentication layer around it.
The number one rule for open-source, self-hosted apps:
Have OIDC.
If you're running a tool with 15–20 employees, authentication quickly becomes more than just “can this person log in?”
You need a central identity provider to control who has access, what happens when someone joins or leaves the company, and how permissions are managed across your stack. With OIDC, employees can use their existing Google Workspace, Microsoft Entra ID, Authentik, Keycloak, etc. identity instead of creating another account and password specifically for Macro.
More importantly, when an employee leaves, disabling their company account can immediately revoke their access instead of relying on an admin to remember to delete their account from every self-hosted application.
Anti-example:
Macro is especially well-positioned for this. You're building an entire company operating system - email, chat, docs, tasks, CRM, agents, etc. This is definitely something you'll need, since permissions are already a core part of the architecture.
Please consider adding OIDC as a first-class authentication option for self-hosted Macro.
It would make Macro dramatically easier to deploy in real organizations without forcing every team to build their own authentication layer around it.