diff --git a/assets/pages/index.vue b/assets/pages/index.vue
index e5588d42..1d98b387 100644
--- a/assets/pages/index.vue
+++ b/assets/pages/index.vue
@@ -2,8 +2,11 @@
   <div class="flex flex-col gap-16 px-4 pt-8 md:px-8">
     <section v-if="config.user">
       <div class="flex items-center gap-4">
-        <div class="ml-auto">
-          {{ config.user?.email }}
+        <div class="ml-auto" v-if="config.authProvider === 'simple'">
+          <button @click.prevent="logout()" class="link-primary">{{ $t("button.logout") }}</button>
+        </div>
+        <div>
+          {{ config.user.name ?? config.user.email }}
         </div>
         <img class="h-10 w-10 rounded-full p-1 ring-2 ring-base-content/50" :src="config.user.avatar" />
       </div>
@@ -73,6 +76,14 @@ watchEffect(() => {
     setTitle(t("title.dashboard", { count: runningContainers.length }));
   }
 });
+
+async function logout() {
+  await fetch(withBase("/api/token"), {
+    method: "DELETE",
+  });
+
+  location.reload();
+}
 </script>
 <style lang="postcss" scoped>
 :deep(tr td) {
diff --git a/assets/pages/login.vue b/assets/pages/login.vue
index 57b7160b..66b0c41d 100644
--- a/assets/pages/login.vue
+++ b/assets/pages/login.vue
@@ -49,9 +49,10 @@ let password = $ref("");
 let form: HTMLFormElement | undefined = $ref();
 
 async function onLogin() {
-  const response = await fetch(withBase("/api/validateCredentials"), {
+  const url = config.authProvider === "simple" ? "/api/token" : "/api/validateCredentials";
+  const response = await fetch(withBase(url), {
     body: new FormData(form),
-    method: "post",
+    method: "POST",
   });
 
   if (response.status == 200) {
diff --git a/assets/stores/config.ts b/assets/stores/config.ts
index 5224b0cd..42e92421 100644
--- a/assets/stores/config.ts
+++ b/assets/stores/config.ts
@@ -10,6 +10,7 @@ interface Config {
   maxLogs: number;
   hostname: string;
   hosts: { name: string; id: string }[];
+  authProvider: "simple" | "none" | "forward-proxy";
   user?: {
     username: string;
     email: string;
diff --git a/go.mod b/go.mod
index 6992a58e..84f49757 100644
--- a/go.mod
+++ b/go.mod
@@ -31,11 +31,22 @@ require github.com/go-chi/chi/v5 v5.0.10
 require (
 	github.com/alexflint/go-scalar v1.2.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
+	github.com/go-chi/jwtauth/v5 v5.1.1 // indirect
+	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/google/go-cmp v0.5.5 // indirect
 	github.com/gorilla/securecookie v1.1.1 // indirect
 	github.com/kr/pretty v0.2.1 // indirect
+	github.com/lestrrat-go/blackmagic v1.0.1 // indirect
+	github.com/lestrrat-go/httpcc v1.0.1 // indirect
+	github.com/lestrrat-go/httprc v1.0.4 // indirect
+	github.com/lestrrat-go/iter v1.0.2 // indirect
+	github.com/lestrrat-go/jwx/v2 v2.0.11 // indirect
+	github.com/lestrrat-go/option v1.0.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/segmentio/asm v1.2.0 // indirect
+	golang.org/x/crypto v0.12.0 // indirect
 	golang.org/x/mod v0.12.0 // indirect
 	golang.org/x/text v0.12.0 // indirect
 	golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e // indirect
diff --git a/go.sum b/go.sum
index 30c66296..3618bce8 100644
--- a/go.sum
+++ b/go.sum
@@ -61,6 +61,9 @@ github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/decred/dcrd/crypto/blake256 v1.0.1/go.mod h1:2OfgNZ5wDpcsFmHmCK5gZTPcCXqlm2ArzUIkw9czNJo=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 h1:8UrgZ3GkP4i/CLijOJx79Yu+etlyjdBU4sfcs2WYQMs=
+github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0/go.mod h1:v57UDF4pDQJcEfFUCRop3lJL149eHGSe9Jvczhzjo/0=
 github.com/docker/distribution v2.8.2+incompatible h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8=
 github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v24.0.5+incompatible h1:WmgcE4fxyI6EEXxBRxsHnZXrO1pQ3smi0k/jho4HLeY=
@@ -83,9 +86,13 @@ github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.m
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/go-chi/chi/v5 v5.0.10 h1:rLz5avzKpjqxrYwXNfmjkrYYXOyLJd37pz53UFHC6vk=
 github.com/go-chi/chi/v5 v5.0.10/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
+github.com/go-chi/jwtauth/v5 v5.1.1 h1:Pjixqu5YkjE9sCLpzE01L0Q4sQzJIPdo7uz9r8ftp/c=
+github.com/go-chi/jwtauth/v5 v5.1.1/go.mod h1:CYP1WSbzD4MPuKCr537EM3kfFhSQgpUEtMJFuYJjqWU=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
+github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
@@ -163,6 +170,19 @@ github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfn
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/lestrrat-go/blackmagic v1.0.1 h1:lS5Zts+5HIC/8og6cGHb0uCcNCa3OUt1ygh3Qz2Fe80=
+github.com/lestrrat-go/blackmagic v1.0.1/go.mod h1:UrEqBzIR2U6CnzVyUtfM6oZNMt/7O7Vohk2J0OGSAtU=
+github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
+github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
+github.com/lestrrat-go/httprc v1.0.4 h1:bAZymwoZQb+Oq8MEbyipag7iSq6YIga8Wj6GOiJGdI8=
+github.com/lestrrat-go/httprc v1.0.4/go.mod h1:mwwz3JMTPBjHUkkDv/IGJ39aALInZLrhBp0X7KGUZlo=
+github.com/lestrrat-go/iter v1.0.2 h1:gMXo1q4c2pHmC3dn8LzRhJfP1ceCbgSiT9lUydIzltI=
+github.com/lestrrat-go/iter v1.0.2/go.mod h1:Momfcq3AnRlRjI5b5O8/G5/BvpzrhoFTZcn06fEOPt4=
+github.com/lestrrat-go/jwx/v2 v2.0.11 h1:ViHMnaMeaO0qV16RZWBHM7GTrAnX2aFLVKofc7FuKLQ=
+github.com/lestrrat-go/jwx/v2 v2.0.11/go.mod h1:ZtPtMFlrfDrH2Y0iwfa3dRFn8VzwBrB+cyrm3IBWdDg=
+github.com/lestrrat-go/option v1.0.0/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
+github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU=
+github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
 github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
 github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/moby/term v0.0.0-20201216013528-df9cb8a40635 h1:rzf0wL0CHVc8CEsgyygG0Mn9CNCCPZqOPaz8RiiHYQk=
@@ -181,6 +201,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
+github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys=
+github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
 github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
@@ -197,6 +219,7 @@ github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpE
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
@@ -206,6 +229,7 @@ github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
@@ -218,7 +242,11 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
+golang.org/x/crypto v0.12.0 h1:tFM/ta59kqch6LlvYnPa0yx5a83cL2nHflFhYKvv9Yk=
+golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -252,6 +280,8 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -286,6 +316,9 @@ golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.14.0 h1:BONx9s002vGdD9umnlX1Po8vOZmrgH34qlHcD1MfK14=
 golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -307,6 +340,8 @@ golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -345,10 +380,18 @@ golang.org/x/sys v0.0.0-20210225134936-a50acf3fe073/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -357,6 +400,8 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.12.0 h1:k+n5B8goJNdU7hSvEtMUz3d1Q6D/XW4COJSJR6fN0mc=
 golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -414,6 +459,8 @@ golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.12.0 h1:YW6HUoUmYBpwSgyaGaZq1fHjrBjX1rlpZ54T6mu2kss=
 golang.org/x/tools v0.12.0/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/internal/auth/proxy.go b/internal/auth/proxy.go
index 7d085207..4212411e 100644
--- a/internal/auth/proxy.go
+++ b/internal/auth/proxy.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto/md5"
 	"encoding/hex"
+	"log"
 	"net/http"
 	"strings"
 )
@@ -12,11 +13,7 @@ type contextKey string
 
 const remoteUser contextKey = "remoteUser"
 
-type User struct {
-	Username string `json:"username"`
-	Email    string `json:"email"`
-	Name     string `json:"name"`
-	Avatar   string `json:"avatar,omitempty"`
+type proxyAuthAuth struct {
 }
 
 func hashEmail(email string) string {
@@ -27,20 +24,11 @@ func hashEmail(email string) string {
 	return hex.EncodeToString(hash[:])
 }
 
-func newUser(username, email, name string) *User {
-	avatar := ""
-	if email != "" {
-		avatar = "https://gravatar.com/avatar/" + hashEmail(email)
-	}
-	return &User{
-		Username: username,
-		Email:    email,
-		Name:     name,
-		Avatar:   avatar,
-	}
+func NewForwardProxyAuth() *proxyAuthAuth {
+	return &proxyAuthAuth{}
 }
 
-func ForwardProxyAuthorizationRequired(next http.Handler) http.Handler {
+func (p *proxyAuthAuth) AuthMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Header.Get("Remote-Email") != "" {
 			user := newUser(r.Header.Get("Remote-User"), r.Header.Get("Remote-Email"), r.Header.Get("Remote-Name"))
@@ -49,14 +37,10 @@ func ForwardProxyAuthorizationRequired(next http.Handler) http.Handler {
 		} else {
 			next.ServeHTTP(w, r)
 		}
-
 	})
 }
 
-func RemoteUserFromContext(ctx context.Context) *User {
-	user, ok := ctx.Value(remoteUser).(*User)
-	if !ok {
-		return nil
-	}
-	return user
+func (p *proxyAuthAuth) CreateToken(username, password string) (string, error) {
+	log.Fatalf("CreateToken not implemented for proxy auth")
+	return "", nil
 }
diff --git a/internal/auth/simple.go b/internal/auth/simple.go
new file mode 100644
index 00000000..7efb707d
--- /dev/null
+++ b/internal/auth/simple.go
@@ -0,0 +1,49 @@
+package auth
+
+import (
+	"crypto/sha256"
+	"errors"
+	"net/http"
+	"time"
+
+	"github.com/go-chi/jwtauth/v5"
+)
+
+type simpleAuthContext struct {
+	UserDatabase *UserDatabase
+	tokenAuth    *jwtauth.JWTAuth
+}
+
+var ErrInvalidCredentials = errors.New("invalid credentials")
+
+func NewSimpleAuth(userDatabase *UserDatabase) *simpleAuthContext {
+	h := sha256.New()
+	for _, user := range userDatabase.Users {
+		h.Write([]byte(user.Password))
+	}
+
+	tokenAuth := jwtauth.New("HS256", h.Sum(nil), nil)
+
+	return &simpleAuthContext{
+		UserDatabase: userDatabase,
+		tokenAuth:    tokenAuth,
+	}
+}
+
+func (a *simpleAuthContext) CreateToken(username, password string) (string, error) {
+	user := a.UserDatabase.FindByPassword(username, password)
+	if user == nil {
+		return "", ErrInvalidCredentials
+	}
+
+	_, tokenString, err := a.tokenAuth.Encode(map[string]interface{}{"username": user.Username, "email": user.Email, "name": user.Name, "timestamp": time.Now()})
+	if err != nil {
+		return "", err
+	}
+
+	return tokenString, nil
+}
+
+func (a *simpleAuthContext) AuthMiddleware(next http.Handler) http.Handler {
+	return jwtauth.Verifier(a.tokenAuth)(next)
+}
diff --git a/internal/auth/users.go b/internal/auth/users.go
new file mode 100644
index 00000000..1e8b4401
--- /dev/null
+++ b/internal/auth/users.go
@@ -0,0 +1,116 @@
+package auth
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"net/http"
+	"os"
+
+	"github.com/go-chi/jwtauth/v5"
+	"gopkg.in/yaml.v3"
+)
+
+type User struct {
+	Username string `json:"username"`
+	Email    string `json:"email" yaml:"email"`
+	Name     string `json:"name" yaml:"name"`
+	Avatar   string `json:"avatar,omitempty"`
+	Password string `json:"-" yaml:"password"`
+}
+
+func newUser(username, email, name string) *User {
+	avatar := ""
+	if email != "" {
+		avatar = "https://gravatar.com/avatar/" + hashEmail(email)
+	}
+	return &User{
+		Username: username,
+		Email:    email,
+		Name:     name,
+		Avatar:   avatar,
+	}
+}
+
+type UserDatabase struct {
+	Users map[string]*User `yaml:"users"`
+}
+
+func ReadUsersFromFile(path string) (*UserDatabase, error) {
+	users := UserDatabase{}
+	file, err := os.Open(path)
+	if err != nil {
+		return &users, err
+	}
+	defer file.Close()
+
+	if err := yaml.NewDecoder(file).Decode(&users); err != nil {
+		return &users, err
+	}
+
+	for username, user := range users.Users {
+		user.Username = username
+	}
+
+	return &users, nil
+}
+
+func (u *UserDatabase) Find(username string) *User {
+	user, ok := u.Users[username]
+	if !ok {
+		return nil
+	}
+	return user
+}
+
+func (u *UserDatabase) FindByPassword(username, password string) *User {
+	user := u.Find(username)
+
+	if user == nil {
+		return nil
+	}
+
+	if user.Password != sha256sum(password) {
+		return nil
+	}
+	return user
+}
+
+func sha256sum(s string) string {
+	bytes := sha256.Sum256([]byte(s))
+	return hex.EncodeToString(bytes[:])
+}
+
+func UserFromContext(ctx context.Context) *User {
+	_, claims, err := jwtauth.FromContext(ctx)
+
+	if err != nil {
+		user, ok := ctx.Value(remoteUser).(*User)
+		if !ok {
+			return nil
+		}
+		return user
+	} else {
+		username, ok := claims["username"].(string)
+		if !ok {
+			return nil
+		}
+		if username == "" {
+			return nil
+		}
+		email := claims["email"].(string)
+		name := claims["name"].(string)
+		return newUser(username, email, name)
+	}
+}
+
+func RequireAuthentication(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		user := UserFromContext(r.Context())
+		if user != nil {
+			next.ServeHTTP(w, r)
+		} else {
+			http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
+		}
+	})
+}
diff --git a/internal/web/auth.go b/internal/web/auth.go
index f3db5735..b10a5cc8 100644
--- a/internal/web/auth.go
+++ b/internal/web/auth.go
@@ -101,6 +101,40 @@ func (h *handler) validateCredentials(w http.ResponseWriter, r *http.Request) {
 	http.Error(w, http.StatusText(http.StatusUnauthorized), http.StatusUnauthorized)
 }
 
+func (h *handler) createToken(w http.ResponseWriter, r *http.Request) {
+	user := r.PostFormValue("username")
+	pass := r.PostFormValue("password")
+
+	if token, err := h.config.Authorizer.CreateToken(user, pass); err == nil {
+		http.SetCookie(w, &http.Cookie{
+			Name:     "jwt",
+			Value:    token,
+			HttpOnly: true,
+			Path:     "/",
+			SameSite: http.SameSiteLaxMode,
+		})
+		log.Infof("Token created for user %s", user)
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(http.StatusText(http.StatusOK)))
+	} else {
+		log.Errorf("Error while creating token: %v", err)
+		http.Error(w, err.Error(), http.StatusUnauthorized)
+	}
+}
+
+func (h *handler) deleteToken(w http.ResponseWriter, r *http.Request) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     "jwt",
+		Value:    "",
+		HttpOnly: true,
+		Path:     "/",
+		SameSite: http.SameSiteLaxMode,
+		Expires:  time.Unix(0, 0),
+	})
+	w.WriteHeader(http.StatusOK)
+	w.Write([]byte(http.StatusText(http.StatusOK)))
+}
+
 func (h *handler) clearSession(w http.ResponseWriter, r *http.Request) {
 	if !secured {
 		log.Panic("Validating credentials with secured=false should not happen")
diff --git a/internal/web/index.go b/internal/web/index.go
index a6388c48..9f5c10ae 100644
--- a/internal/web/index.go
+++ b/internal/web/index.go
@@ -51,9 +51,9 @@ func (h *handler) executeTemplate(w http.ResponseWriter, req *http.Request) {
 		log.Panic(err)
 	}
 
-	path := ""
+	base := ""
 	if h.config.Base != "/" {
-		path = h.config.Base
+		base = h.config.Base
 	}
 
 	hosts := make([]*docker.Host, 0, len(h.clients))
@@ -65,38 +65,42 @@ func (h *handler) executeTemplate(w http.ResponseWriter, req *http.Request) {
 	})
 
 	config := map[string]interface{}{
-		"base":                path,
+		"base":                base,
 		"version":             h.config.Version,
 		"authorizationNeeded": h.isAuthorizationNeeded(req),
 		"secured":             secured,
 		"hostname":            h.config.Hostname,
 		"hosts":               hosts,
+		"authProvider":        h.config.AuthProvider,
 	}
 
-	if h.config.AuthProvider == FORWARD_PROXY {
-		user := auth.RemoteUserFromContext(req.Context())
-		if user == nil {
-			log.Error("Unable to find remote user. Please check your proxy configuration. Expecting headers Remote-Email, Remote-User, Remote-Name.")
-			log.Debugf("Dumping all headers for url /%s", req.URL.String())
-			for k, v := range req.Header {
-				log.Debugf("%s: %s", k, v)
-			}
-			http.Error(w, "Unauthorized user", http.StatusUnauthorized)
-			return
-		}
-		config["user"] = user
+	user := auth.UserFromContext(req.Context())
+	if user != nil {
 		if settings, err := profile.LoadUserSettings(user); err == nil {
 			config["serverSettings"] = settings
 		} else {
 			config["serverSettings"] = struct{}{}
 		}
+		config["user"] = user
+	} else if h.config.AuthProvider == FORWARD_PROXY {
+		log.Error("Unable to find remote user. Please check your proxy configuration. Expecting headers Remote-Email, Remote-User, Remote-Name.")
+		log.Debugf("Dumping all headers for url /%s", req.URL.String())
+		for k, v := range req.Header {
+			log.Debugf("%s: %s", k, v)
+		}
+		http.Error(w, "Unauthorized user", http.StatusUnauthorized)
+		return
+	} else if h.config.AuthProvider == SIMPLE && req.URL.Path != "login" {
+		log.Debugf("Redirecting to login page for url /%s", req.URL.String())
+		http.Redirect(w, req, path.Clean(h.config.Base+"/login"), http.StatusTemporaryRedirect)
+		return
 	}
 
 	data := map[string]interface{}{
 		"Config":   config,
 		"Dev":      h.config.Dev,
 		"Manifest": h.readManifest(),
-		"Base":     path,
+		"Base":     base,
 	}
 
 	err = tmpl.Execute(w, data)
diff --git a/internal/web/profile.go b/internal/web/profile.go
index f94c43be..5ac28a1e 100644
--- a/internal/web/profile.go
+++ b/internal/web/profile.go
@@ -16,7 +16,7 @@ func (h *handler) saveSettings(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	user := auth.RemoteUserFromContext(r.Context())
+	user := auth.UserFromContext(r.Context())
 	if user == nil {
 		http.Error(w, "Unable to find user", http.StatusInternalServerError)
 		return
diff --git a/internal/web/routes.go b/internal/web/routes.go
index 5c594a23..f0fcbd15 100644
--- a/internal/web/routes.go
+++ b/internal/web/routes.go
@@ -19,6 +19,7 @@ import (
 type AuthProvider string
 
 const (
+	NONE          AuthProvider = "none"
 	SIMPLE        AuthProvider = "simple"
 	FORWARD_PROXY AuthProvider = "forward-proxy"
 )
@@ -34,6 +35,7 @@ type Config struct {
 	NoAnalytics  bool
 	Dev          bool
 	AuthProvider AuthProvider
+	Authorizer   Authorizer
 }
 
 type handler struct {
@@ -54,6 +56,11 @@ type DockerClient interface {
 	Host() *docker.Host
 }
 
+type Authorizer interface {
+	AuthMiddleware(http.Handler) http.Handler
+	CreateToken(string, string) (string, error)
+}
+
 func CreateServer(clients map[string]DockerClient, content fs.FS, config Config) *http.Server {
 	handler := &handler{
 		clients: clients,
@@ -76,19 +83,22 @@ func createRouter(h *handler) *chi.Mux {
 	}
 
 	r.Route(base, func(r chi.Router) {
+		if h.config.Authorizer != nil {
+			r.Use(h.config.Authorizer.AuthMiddleware)
+		}
 		r.Group(func(r chi.Router) {
-			if h.config.AuthProvider == FORWARD_PROXY {
-				r.Use(auth.ForwardProxyAuthorizationRequired)
-			}
 			r.Group(func(r chi.Router) {
-				r.Use(authorizationRequired)
+				if h.config.AuthProvider != NONE {
+					r.Use(auth.RequireAuthentication)
+				}
+				r.Use(authorizationRequired) // TODO remove this
 				r.Get("/api/logs/stream/{host}/{id}", h.streamLogs)
 				r.Get("/api/logs/download/{host}/{id}", h.downloadLogs)
 				r.Get("/api/logs/{host}/{id}", h.fetchLogsBetweenDates)
 				r.Get("/api/events/stream", h.streamEvents)
-				r.Get("/logout", h.clearSession)
-				r.Get("/version", h.version)
 				r.Put("/api/profile/settings", h.saveSettings)
+				r.Get("/logout", h.clearSession) // TODO remove this
+				r.Get("/version", h.version)
 			})
 
 			defaultHandler := http.StripPrefix(strings.Replace(base+"/", "//", "/", 1), http.HandlerFunc(h.index))
@@ -97,7 +107,12 @@ func createRouter(h *handler) *chi.Mux {
 			})
 		})
 
-		r.Post("/api/validateCredentials", h.validateCredentials)
+		if h.config.AuthProvider == SIMPLE {
+			r.Post("/api/token", h.createToken)
+			r.Delete("/api/token", h.deleteToken)
+		}
+
+		r.Post("/api/validateCredentials", h.validateCredentials) // TODO remove this
 		r.Get("/healthcheck", h.healthcheck)
 	})
 
diff --git a/internal/web/routes_auth_test.go b/internal/web/routes_auth_test.go
index 3734016b..6c0470a7 100644
--- a/internal/web/routes_auth_test.go
+++ b/internal/web/routes_auth_test.go
@@ -92,7 +92,7 @@ func Test_createRoutes_foobar_file(t *testing.T) {
 func Test_createRoutes_version(t *testing.T) {
 	fs := afero.NewMemMapFs()
 	require.NoError(t, afero.WriteFile(fs, "index.html", []byte("index page"), 0644), "WriteFile should have no error.")
-	handler := createHandler(nil, afero.NewIOFS(fs), Config{Base: "/", Version: "dev"})
+	handler := createHandler(nil, afero.NewIOFS(fs), Config{Base: "/", Version: "dev", AuthProvider: NONE})
 	req, err := http.NewRequest("GET", "/version", nil)
 	require.NoError(t, err, "NewRequest should not return an error.")
 	rr := httptest.NewRecorder()
@@ -181,7 +181,7 @@ func Test_createRoutes_username_password_valid_session(t *testing.T) {
 	mockedClient := new(MockedClient)
 	mockedClient.On("FindContainer", "123").Return(docker.Container{ID: "123"}, nil)
 	mockedClient.On("ContainerLogs", mock.Anything, "123", "", docker.STDALL).Return(io.NopCloser(strings.NewReader("test data")), io.EOF)
-	handler := createHandler(mockedClient, nil, Config{Base: "/", Username: "amir", Password: "password"})
+	handler := createHandler(mockedClient, nil, Config{Base: "/", Username: "amir", Password: "password", AuthProvider: NONE})
 
 	// Get cookie first
 	req, err := http.NewRequest("GET", "/api/logs/stream/localhost/123?stdout=1&stderr=1", nil)
diff --git a/internal/web/routes_test.go b/internal/web/routes_test.go
index 5a8c2fce..711a66b5 100644
--- a/internal/web/routes_test.go
+++ b/internal/web/routes_test.go
@@ -80,5 +80,5 @@ func createHandler(client DockerClient, content fs.FS, config Config) *chi.Mux {
 }
 
 func createDefaultHandler(client DockerClient) *chi.Mux {
-	return createHandler(client, nil, Config{Base: "/"})
+	return createHandler(client, nil, Config{Base: "/", AuthProvider: NONE})
 }
diff --git a/main.go b/main.go
index 30166025..eb829780 100644
--- a/main.go
+++ b/main.go
@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"reflect"
 	"strings"
 	"syscall"
@@ -14,6 +15,7 @@ import (
 
 	"github.com/alexflint/go-arg"
 	"github.com/amir20/dozzle/internal/analytics"
+	"github.com/amir20/dozzle/internal/auth"
 	"github.com/amir20/dozzle/internal/docker"
 	"github.com/amir20/dozzle/internal/healthcheck"
 	"github.com/amir20/dozzle/internal/web"
@@ -173,11 +175,27 @@ func createClients(args args,
 func createServer(args args, clients map[string]web.DockerClient) *http.Server {
 	_, dev := os.LookupEnv("DEV")
 
-	var provider web.AuthProvider
+	var provider web.AuthProvider = web.NONE
+	var authorizer web.Authorizer
 	if args.AuthProvider == "forward-proxy" {
 		provider = web.FORWARD_PROXY
+		authorizer = auth.NewForwardProxyAuth()
 	} else if args.AuthProvider == "simple" {
 		provider = web.SIMPLE
+
+		path, err := filepath.Abs("./data/users.yml")
+		if err != nil {
+			log.Fatalf("Could not find absolute path to users.yml file: %s", err)
+		}
+		if _, err := os.Stat(path); os.IsNotExist(err) {
+			log.Fatalf("Could not find users.yml file at %s", path)
+		}
+
+		users, err := auth.ReadUsersFromFile(path)
+		if err != nil {
+			log.Fatalf("Could not read users.yml file at %s: %s", path, err)
+		}
+		authorizer = auth.NewSimpleAuth(users)
 	}
 
 	config := web.Config{
@@ -190,6 +208,7 @@ func createServer(args args, clients map[string]web.DockerClient) *http.Server {
 		NoAnalytics:  args.NoAnalytics,
 		Dev:          dev,
 		AuthProvider: provider,
+		Authorizer:   authorizer,
 	}
 
 	assets, err := fs.Sub(content, "dist")