Put Authentication Before AI Budgets: oauth2-proxy for a Ten-Person Team

At 3:00 AM, an engineer deploys a retry loop. Authentication is working perfectly, the session is valid, and the AI provider accepts every request—until the team wakes up to a blown budget and an invoice nobody expected. The failure is not identity. It is admission control.

For a small engineering team, I would evaluate oauth2-proxy as the identity boundary, not the quota engine. It authenticates people through an identity provider and forwards their identity upstream. A separate, private gateway must decide whether each request can spend money.

The architecture is deliberately small:

Developer → oauth2-proxy → local budget gateway → AI relay

The example uses https://b-lost.com/v1 as the relay endpoint. That configuration does not establish its retention policy or pricing; both require separate verification.

Reserve Before Forwarding

Checking yesterday's usage does not stop today's concurrent requests.…