Pomerium is an identity- and context-aware reverse proxy. It sits in front of internal web applications and other services and authorises every request against central policy, so people reach those services without a client install and without a corporate VPN tunnel.
It is a layer 7 proxy built on Envoy that integrates with an existing OIDC-compliant identity provider. Policy is written as YAML and enforced continuously rather than once at login, connections to upstream applications carry cryptographically signed JWTs, and every request is logged regardless of the identity type behind it. Because it deploys next to the applications it protects, traffic does not detour through a tunnel.
Documented use cases include Kubernetes access covering ingress, kubectl, the Gateway API, and upstream applications; access for remote employees, contractors, and distributed teams; and an agentic gateway that applies per-request authorisation and logging to requests made by AI agents. The proxy is self-hosted; a hosted control plane with a management interface is offered separately as Pomerium Zero.
Features
- Clientless access: users reach internal services through the proxy without installing a VPN client
- Identity provider integration: works with an existing OIDC-compliant identity provider
- Policy as code: centrally defined YAML policy authorises each action, not just the initial login
- Signed upstream connections: upstream applications receive cryptographically signed JWTs
- Request logging: every request is logged regardless of identity type, for continuous verification and audit
- Envoy foundation: the layer 7 data plane is built on Envoy proxy
- Agent gateway: per-request authorisation and logging for agentic traffic
- Kubernetes access: secures ingress, kubectl, the Gateway API, and the applications behind them
