Better yet, oauth2-proxy in case of an organization: only admins need to know the secrets, every user simply uses SSO to get access.