Netlify Identity is being deprecated, what does the future of it's use with Decap and Git Gateway look like? #7419
|
I use Decap on a number of websites that I deploy for clients via Netlify. The integration with Netlify Identity, and more importantly with Git Gateway has made allowing clients to easily update the content on their websites a breeze. I was super bummed to log into my Netlify dashboard to see that Identity (which Git Gateway is a part of) is being deprecated.
As you can see, there is no intent for removing the feature outright right now, which is fine for the short term, but this has other implications. First of all, I don't trust when they say it that Identity will be around indefinitely - you deprecate something because you intend on getting rid of it eventually. Second of all, this means that there will be no updates/maintenance for Identity or Git Gateway from Netlify moving forward (it's been 9 months since the last Git Gateway update). Presumably at some point something could change with GitHub, for example, and everything will stop working - not to mention security issues. Finally, I don't get the impression (I need to look into it more though) that their alleged replacement, the Auth0 extension, offers functionality similar to Git Gateway (Auth0 is a third party service, by Okta I believe). I guess potentially losing Git Gateway is the big concern for me, because it is the only relatively streamlined & affordable method I had found to authenticate CMS users for a static site without them needing something like a GitHub account (mom and pop shop down the street don't/won't have one, that's why they hire me in the first place). I know you can use Git Gateway without Netlify, but I think it's obvious that spinning up and maintaining authentication servers is not the next best option for most people using Identity + Git Gateway. So I'm kind of wondering what the future of Netlify Identity and Git Gateway are looking like for this project? It is clear when you read the docs that the Identity + Git Gateway combo are basically the recommended way of doing things currently. I love this project and my current setup for using Decap with Netlify Identity + Git Gateway is truly unbeatable. As time goes on though, I am going to grow less okay with using something that has been deprecated. I imagine new users will not be okay from the get go using something that has been deprecated. Would love to hear anybody's thoughts/solutions/alternative on the matter, especially from the devs! Thank you in advance 😁, |
Replies: 7 comments 9 replies
|
@TheNickOfTime thanks for expressing your concern. Yes, Decap is basically married to Netlify Identity, and as maintainers, we are aware that a divorce is long overdue. Since Netlify moved to auth0, we will also update our guides to recommend the new approach. There is no timeline for this as this is a non-funded open-source project. We gladly accept contributions if anyone would like to speed up the process. This will become our priority as soon as we merge some open PRs. In the meantime, I invite everyone to contribute to this discussion with ideas on moving away from Netlify. |
|
Task for integrating Auht0 here: #7420 |
|
Good day, all. I just submitted a PR that should help to separate the dependency of the git-gateway back-end on the Netlify Identity authentication. It adds optional PKCE support to the git-gateway backend, so any OAuth2 PKCE provider can be used for authentication with git-gateway. Here is my PR: #7439 This solves half of the problem, in my opinion -- git-gateway still needs to be runnable in a serverless environment (or at least without needing a database). But please take a look at my PR and see if you think it's a good start on using other authentication providers. I haven't specifically used Auth0, but I expect they fully support PKCE, so this could help out with that solution, too. Note: this solution assumes you're using a custom git-gateway that is configured to recognize bearer tokens from your configured issuer. That's my next task, to see if I can get that up and running. |
|
Thank you for your response! In terms of moving away from Netlify, I would take a look at how competitors are handling things. From my research looking into Git-based headless CMS options, the only other reasonably developed option was TinaCMS. Aside from DecapCMS, this was the one standout option that allows functionality similar to Git Gateway - authenticating users that aren't contributors to your repo. The way they achieve this (without Netlify Identity as a convenient backend) is interesting - they provide a paid cloud service for easy deployment, but you can also self-host the components of that cloud service. The tricky part seems to, of course, be authentication. With Tina, it seems you can 'self-host' a backend via Netlify Functions or similar, but by default they rely on an external database for authorizing users via Auth.js. Obviously the architecture of Decap vs Tina are probably quite different, but I think the need to 'self-host' certain aspects in the absence of Netlify Identity is unavoidable. In terms of achieving the most with the least amount of work, I wonder about the feasibility of 'self-hosting' Git Gateway in Netlify functions and integrating it with something like Auth0 for authentication. I don't know much about Go, which is what Git Gateway appears to be written in, but it seems from preliminary research that Netlify Functions does support Go. I'll try to spend some time today determining if it is possible or not to run Git Gateway in a serverless functions environment. If this is possible, perhaps a good way forward is simply more robust docs on setting up Git Gateway without Netlify in common serverless environments, and having a recommended Auth service (likely one with a good free tier) that can issue JWTs to a serverless instance of Git Gateway. Of course the Git Gateway project is likely abandoned by Netlify, so other solutions may be necessary in the long term. While it is open sourced, the question of "who is going to fork and maintain it?" is relevant, since as you said Decap is a non-funded project, and I imagine already starved of ideal time and resources. |
|
There's also Pages CMS: they run a hosted auth option for you, but provide instructions to deploy to Vercel yourself, or self-host. The limitation is that only GitHub is supported currently, but as a GitHub user, the experience was super smooth. |
|
I was able to get Git Gateway running locally as a Netlify Function via
I ran into issues with function errors deploying on Netlify because it needs access to a sqlite database, and as far as I can tell the way they have their orm configured doesn't work with a network sqlite db, like from Turso. Bit of a half success, but seems like it is plausible. |
|
So, I don't know Go at all, either, so I spent some time and threw together a rough Node.js implementation of git-gateway that runs on AWS Lambda (serverless). It also currently does not use any database -- user assignments to repos are done through environment variables in the Lambda, although it could be improved in the future if more data is needed to be stored per user. So far, I only added Bitbucket support, but including Github/Gitlab shouldn't be too hard, since most of the work of the application is proxying the request directly to the vendor API. It would just be a matter of adding the correct proxy paths in the code. The code is here, along with instructions for setting it up. MIT license, so free to use. |
|
We already had an idea of a paid cloud service you can self-host because it's also a way to fund the project. Yes, git gateway seems abandoned. I believe Decap is the largest user, so it would make sense for us to fork it if we decide to use it in the future. If we can get it to run in a serverless environment, it's at least a temporary solution. In the long run, we have to determine if it's reliable enough. |
|
I would gladly pay a monthly fee to suppor this project if the fee was setup where you pay X and you can use it on a large number of sites like 15-25+. |
|
I have a client who is overhauling their site and would like to continue using Decap, but the status of this auth situation is a major concern. Having a paid option that also helps support the project would be really great for them (most of the other CMS options we are evaluating are paid). |
|
A bit late to the party but I think I need to share that I've been slowly developing DecapBridge, a fully-featured auth solution specifically for DecapCMS. It's been up for nearly a year now with hundreds of sites using it. I must admit new features development has been slower over the winter, but I'm still planning to complete the current roadmap, hopefully by the end of this summer, which includes an open-sourced self hosted version. The cloud version will always remain free for small sites (<10 users), but I'm planning an enterprise version to help support development and continue the free hosted service for smaller orgs. When I started this last year, I did not know Netlify was going to deprecate Netlify Auth, so it was more meant as a "additional option" for DecapCMS and a smoother experience for my clients. Now that Netlify Auth is slowly stepping away, it seems it could become a bigger Open-Source solution for everyone to benefit from. |
|
Seems like a game changer to me! I am trying to get it to work with an existing netlify site, but in spite of adding the backend config, to config.yml, the 'login' button still goes to netlify identity? Even if I disable Netlify identity, it still tries, is there a setting somewhere that is overriding backend config? |
|
DecapBridge looks pretty cool, and if your users have a Google or Microsoft account, this seems to be the way to go for now. (Perhaps the Decap and DecapBridge projects should be merged somehow? But I'll leave that up to you guys to discuss.) But I've been also thinking about an alternative route. What if we would double-down on GitHub (I know it's not universally popular company, but at least it's going to still be around in 5-10 years). Obviously this would mean using GitHub as an identity provider (it's not worse for users to create an account there than at Netlify Identity was, they usually don't know either service), but perhaps this could also allow us to get rid of Git Gateway (which was supporting only GitHub and GitLab anyway) in favour of directly accessing the GitHub API, perhaps using the official octokit sdk? I haven't evaluated this deeply, but the idea would be to streamline and simplify the whole pipeline and replace all the Go parts with JavaScript/TypeScript, so that there is a chance for a smaller volunteer team to keep it working well into the future. Thoughts? Is this an option this project is willing to consider, or is doubling down on GitHub not an option? (It's what Pages CMS did, and that looks also like a nice project, but I somewhat dislike that it requires a database – seems to sort of defeat the point of a git-based CMS in terms of sustainably operating it.) |
|
Update: I've since started using https://sveltiacms.app (pretty much a drop-in replacement for Decap), and it works well for me. |
|
@mb21 the shape you're describing works - I've been running it. I built a git-native CMS (github.com/plain-cms/plain, mine, 14 stars, so weigh it accordingly) where the browser talks to api.github.com directly using a fine-grained token, or through a ~60-line Cloudflare OAuth worker if you want a sign-in button. No Go, no gateway, no database, and the admin is static files served from the site itself. As a maintainability argument it holds up: everything that can break is readable in an afternoon. It does not solve what @TheNickOfTime opened with, though. Doubling down on GitHub trades a maintenance problem for an identity problem - every editor needs a GitHub account, and the shop down the street still won't make one. That part only hosted auth (DecapBridge-style) covers. Also worth flagging here: Netlify updated the Auth0/Identity post on 19 Feb 2026 to say Identity continues as a supported option, so the immediate fire is out. |
|
Netlify Identity is not deprecated anymore. Netlify says it is staying: https://answers.netlify.com/t/netlify-identity-is-staying-feb-2026-reversal-what-changed-whos-affected-and-how-to-proceed/162733 Thanks for mentioning this @victorantos. This completely flew past me. I wish Netlify would notify us in some way. I'm flagging this as the answer for anyone new coming here. But feel free to continue the discussion on alternatives. |
Netlify Identity is not deprecated anymore. Netlify says it is staying: https://answers.netlify.com/t/netlify-identity-is-staying-feb-2026-reversal-what-changed-whos-affected-and-how-to-proceed/162733
Thanks for mentioning this @victorantos. This completely flew past me. I wish Netlify would notify us in some way. I'm flagging this as the answer for anyone new coming here. But feel free to continue the discussion on alternatives.