Empire Access puts an identity gate in front of any web app at the edge. Add one Traefik label and every request is checked against your Empire identity before it ever reaches the app. Self-hosted. No per-app SDK.
See pricing Read the docsTraefik consults one
/verify endpoint for every protected route. Apps ship with zero auth code.
Per-client rate-limiting and hardened security headers (HSTS, frame-deny, no-sniff) chain in as reusable middlewares.
Backed by EliteSSO / empire-auth JWT. Emergency owner key + magic-link login. Never-locked-out by design.
Same edge-SSO model, a third of the price, self-hostable.
| Cloudflare Access | Empire Access | |
|---|---|---|
| Price / user / mo | $3 – $7 | $2 – $5 |
| Per-app auth code | None (edge) | None (edge) |
| Self-host option | No | Yes |
| Add an app | Dashboard policy | One Traefik label |
| Rate-limit / WAF-lite | Add-on tiers | Included |