diff --git a/web/src/admin/applications/ApplicationForm.ts b/web/src/admin/applications/ApplicationForm.ts
index c8aaefda5..42489f9f3 100644
--- a/web/src/admin/applications/ApplicationForm.ts
+++ b/web/src/admin/applications/ApplicationForm.ts
@@ -159,7 +159,7 @@ export class ApplicationForm extends ModelForm<Application, string> {
                 value=${this.instance?.group}
                 label=${msg("Group")}
                 help=${msg(
-                    "Optionally enter a group name. Applications with identical groups are shown grouped together."
+                    "Optionally enter a group name. Applications with identical groups are shown grouped together.",
                 )}
             ></ak-text-input>
             <ak-provider-search-input
@@ -173,7 +173,7 @@ export class ApplicationForm extends ModelForm<Application, string> {
                 name="backchannelProviders"
                 label=${msg("Backchannel Providers")}
                 help=${msg(
-                    "Select backchannel providers which augment the functionality of the main provider."
+                    "Select backchannel providers which augment the functionality of the main provider.",
                 )}
                 .providers=${this.backchannelProviders}
                 .confirm=${this.handleConfirmBackchannelProviders}
@@ -199,7 +199,7 @@ export class ApplicationForm extends ModelForm<Application, string> {
                         label=${msg("Launch URL")}
                         value=${ifDefined(this.instance?.metaLaunchUrl)}
                         help=${msg(
-                            "If left empty, authentik will try to extract the launch URL based on the selected provider."
+                            "If left empty, authentik will try to extract the launch URL based on the selected provider.",
                         )}
                     ></ak-text-input>
                     <ak-switch-input
@@ -207,7 +207,7 @@ export class ApplicationForm extends ModelForm<Application, string> {
                         ?checked=${first(this.instance?.openInNewTab, false)}
                         label=${msg("Open in new tab")}
                         help=${msg(
-                            "If checked, the launch URL will open in a new browser tab or window from the user's application library."
+                            "If checked, the launch URL will open in a new browser tab or window from the user's application library.",
                         )}
                     >
                     </ak-switch-input>
diff --git a/web/src/admin/applications/components/ak-backchannel-input.ts b/web/src/admin/applications/components/ak-backchannel-input.ts
index 99cbfb30f..2130ba10b 100644
--- a/web/src/admin/applications/components/ak-backchannel-input.ts
+++ b/web/src/admin/applications/components/ak-backchannel-input.ts
@@ -56,12 +56,12 @@ export class AkBackchannelProvidersInput extends AKElement {
             html`<ak-chip
                 .removable=${true}
                 value=${ifDefined(provider.pk)}
-                @remove=${remove(provider)}
+                @remove=${this.remover(provider)}
                 >${provider.name}</ak-chip
             >`;
 
         return html`
-            <ak-form-element-horizontal label=${label} name=${name}>
+            <ak-form-element-horizontal label=${this.label} name=${name}>
                 <div class="pf-c-input-group">
                     <ak-provider-select-table ?backchannelOnly=${true} .confirm=${confirm}>
                         <button slot="trigger" class="pf-c-button pf-m-control" type="button">
@@ -70,10 +70,10 @@ export class AkBackchannelProvidersInput extends AKElement {
                         </button>
                     </ak-provider-select-table>
                     <div class="pf-c-form-control">
-                        <ak-chip-group> ${map(providers, renderOneChip)} </ak-chip-group>
+                        <ak-chip-group> ${map(this.providers, renderOneChip)} </ak-chip-group>
                     </div>
                 </div>
-                ${help ? html`<p class="pf-c-form__helper-radio">${help}</p>` : nothing}
+                ${this.help ? html`<p class="pf-c-form__helper-radio">${this.help}</p>` : nothing}
             </ak-form-element-horizontal>
         `;
     }
diff --git a/web/src/admin/applications/wizard/proxy/ak-application-wizard-authentication-by-proxy.ts b/web/src/admin/applications/wizard/proxy/ak-application-wizard-authentication-by-proxy.ts
new file mode 100644
index 000000000..ea7df221e
--- /dev/null
+++ b/web/src/admin/applications/wizard/proxy/ak-application-wizard-authentication-by-proxy.ts
@@ -0,0 +1,371 @@
+import { DEFAULT_CONFIG } from "@goauthentik/common/api/config";
+import { first } from "@goauthentik/common/utils";
+import "@goauthentik/elements/forms/HorizontalFormElement";
+
+import { msg } from "@lit/localize";
+import { customElement, state } from "@lit/reactive-element/decorators.js";
+import { TemplateResult, html } from "lit";
+import { ifDefined } from "lit/directives/if-defined.js";
+
+import "@goauthentik/components/ak-switch-input";
+import "@goauthentik/components/ak-text-input";
+import "@goauthentik/components/ak-textarea-input";
+import "@goauthentik/components/ak-toggle-group";
+
+import {
+    FlowsInstancesListDesignationEnum,
+    PaginatedOAuthSourceList,
+    PaginatedScopeMappingList,
+    PropertymappingsApi,
+    ProxyMode,
+    ProxyProvider,
+    SourcesApi,
+} from "@goauthentik/api";
+
+import ApplicationWizardPageBase from "../ApplicationWizardPageBase";
+
+@customElement("ak-application-wizard-authentication-by-proxy")
+export class AkTypeProxyApplicationWizardPage extends ApplicationWizardPageBase {
+    constructor() {
+        super();
+        new PropertymappingsApi(DEFAULT_CONFIG)
+            .propertymappingsScopeList({ ordering: "scope_name" })
+            .then((propertyMappings: PaginatedScopeMappingList) => {
+                this.propertyMappings = propertyMappings;
+            });
+
+        new SourcesApi(DEFAULT_CONFIG)
+            .sourcesOauthList({
+                ordering: "name",
+                hasJwks: true,
+            })
+            .then((oauthSources: PaginatedOAuthSourceList) => {
+                this.oauthSources = oauthSources;
+            });
+    }
+
+    handleChange(ev: InputEvent) {
+        if (!ev.target) {
+            console.warn(`Received event with no target: ${ev}`);
+            return;
+        }
+        const target = ev.target as HTMLInputElement;
+        const value = target.type === "checkbox" ? target.checked : target.value;
+        this.dispatchWizardUpdate({
+            provider: {
+                ...this.wizard.provider,
+                [target.name]: value,
+            },
+        });
+    }
+
+    propertyMappings?: PaginatedScopeMappingList;
+    oauthSources?: PaginatedOAuthSourceList;
+
+    @state()
+    showHttpBasic = true;
+
+    @state()
+    mode: ProxyMode = ProxyMode.Proxy;
+
+    get instance(): ProxyProvider | undefined {
+        return this.wizard.provider as ProxyProvider;
+    }
+
+    renderHttpBasic(): TemplateResult {
+        return html`<ak-text-input
+                name="basicAuthUserAttribute"
+                label=${msg("HTTP-Basic Username Key")}
+                value="${ifDefined(this.instance?.basicAuthUserAttribute)}"
+                help=${msg(
+                    "User/Group Attribute used for the user part of the HTTP-Basic Header. If not set, the user's Email address is used.",
+                )}
+            >
+            </ak-text-input>
+
+            <ak-text-input
+                name="basicAuthPasswordAttribute"
+                label=${msg("HTTP-Basic Password Key")}
+                value="${ifDefined(this.instance?.basicAuthPasswordAttribute)}"
+                help=${msg(
+                    "User/Group Attribute used for the password part of the HTTP-Basic Header.",
+                )}
+            >
+            </ak-text-input>`;
+    }
+
+    renderModeSelector(): TemplateResult {
+        const setMode = (ev: CustomEvent<{ value: ProxyMode }>) => {
+            this.mode = ev.detail.value;
+        };
+
+        // prettier-ignore
+        return html`
+            <ak-toggle-group value=${this.mode} @ak-toggle=${setMode}>
+                <option value=${ProxyMode.Proxy}>${msg("Proxy")}</option>
+                <option value=${ProxyMode.ForwardSingle}>${msg("Forward auth (single application)")}</option>
+                <option value=${ProxyMode.ForwardDomain}>${msg("Forward auth (domain level)")}</option>
+            </ak-toggle-group>
+        `;
+    }
+
+    renderProxyModeProxy() {
+        return html`<p class="pf-u-mb-xl">
+                ${msg(
+                    "This provider will behave like a transparent reverse-proxy, except requests must be authenticated. If your upstream application uses HTTPS, make sure to connect to the outpost using HTTPS as well.",
+                )}
+            </p>
+            <ak-text-input
+                name="externalHost"
+                value=${ifDefined(this.instance?.externalHost)}
+                required
+                label=${msg("External host")}
+                help=${msg(
+                    "The external URL you'll access the application at. Include any non-standard port.",
+                )}
+            ></ak-text-input>
+            <ak-text-input
+                name="internalHost"
+                value=${ifDefined(this.instance?.internalHost)}
+                required
+                label=${msg("Internal host")}
+                help=${msg("Upstream host that the requests are forwarded to.")}
+            ></ak-text-input>
+            <ak-switch-input
+                name="internalHostSslValidation"
+                ?checked=${first(this.instance?.internalHostSslValidation, true)}
+                label=${msg("Internal host SSL Validation")}
+                help=${msg("Validate SSL Certificates of upstream servers.")}
+            >
+            </ak-switch-input>`;
+    }
+
+    renderProxyModeForwardSingle() {
+        return html`<p class="pf-u-mb-xl">
+                ${msg(
+                    "Use this provider with nginx's auth_request or traefik's forwardAuth. Each application/domain needs its own provider. Additionally, on each domain, /outpost.goauthentik.io must be routed to the outpost (when using a manged outpost, this is done for you).",
+                )}
+            </p>
+            <ak-text-input
+                name="externalHost"
+                value=${ifDefined(this.instance?.externalHost)}
+                required
+                label=${msg("External host")}
+                help=${msg(
+                    "The external URL you'll access the application at. Include any non-standard port.",
+                )}
+            ></ak-text-input>`;
+    }
+
+    renderProxyModeForwardDomain() {
+        return html`<p class="pf-u-mb-xl">
+                ${msg(
+                    "Use this provider with nginx's auth_request or traefik's forwardAuth. Only a single provider is required per root domain. You can't do per-application authorization, but you don't have to create a provider for each application.",
+                )}
+            </p>
+            <div class="pf-u-mb-xl">
+                ${msg("An example setup can look like this:")}
+                <ul class="pf-c-list">
+                    <li>${msg("authentik running on auth.example.com")}</li>
+                    <li>${msg("app1 running on app1.example.com")}</li>
+                </ul>
+                ${msg(
+                    "In this case, you'd set the Authentication URL to auth.example.com and Cookie domain to example.com.",
+                )}
+            </div>
+            <ak-text-input
+                name="externalHost"
+                value=${first(this.instance?.externalHost, window.location.origin)}
+                required
+                label=${msg("Authentication URL")}
+                help=${msg(
+                    "The external URL you'll authenticate at. The authentik core server should be reachable under this URL.",
+                )}
+            ></ak-text-input>
+            <ak-text-input
+                name="cookieDomain"
+                value=${ifDefined(this.instance?.cookieDomain)}
+                required
+                label=${msg("Cookie domain")}
+                help=${msg(
+                    "Set this to the domain you wish the authentication to be valid for. Must be a parent domain of the URL above. If you're running applications as app1.domain.tld, app2.domain.tld, set this to 'domain.tld'.",
+                )}
+            ></ak-text-input>`;
+    }
+
+    renderSettings() {
+        switch (this.mode) {
+            case ProxyMode.Proxy:
+                return this.renderProxyModeProxy();
+            case ProxyMode.ForwardSingle:
+                return this.renderProxyModeForwardSingle();
+            case ProxyMode.ForwardDomain:
+                return this.renderProxyModeForwardDomain();
+            case ProxyMode.UnknownDefaultOpenApi:
+                return html`<p>${msg("Unknown proxy mode")}</p>`;
+        }
+    }
+
+    render() {
+        return html`<form class="pf-c-form pf-m-horizontal" @input=${this.handleChange}>
+            <ak-text-input
+                name="name"
+                value=${ifDefined(this.instance?.name)}
+                required
+                label=${msg("Name")}
+            ></ak-text-input>
+            <ak-form-element-horizontal
+                label=${msg("Authentication flow")}
+                ?required=${false}
+                name="authenticationFlow"
+            >
+                <ak-flow-search
+                    flowType=${FlowsInstancesListDesignationEnum.Authentication}
+                    .currentFlow=${this.instance?.authenticationFlow}
+                    required
+                ></ak-flow-search>
+                <p class="pf-c-form__helper-text">
+                    ${msg("Flow used when a user access this provider and is not authenticated.")}
+                </p>
+            </ak-form-element-horizontal>
+            <ak-form-element-horizontal
+                label=${msg("Authorization flow")}
+                ?required=${true}
+                name="authorizationFlow"
+            >
+                <ak-flow-search
+                    flowType=${FlowsInstancesListDesignationEnum.Authorization}
+                    .currentFlow=${this.instance?.authorizationFlow}
+                    required
+                ></ak-flow-search>
+                <p class="pf-c-form__helper-text">
+                    ${msg("Flow used when authorizing this provider.")}
+                </p>
+            </ak-form-element-horizontal>
+
+            <div class="pf-c-card pf-m-selectable pf-m-selected">
+                <div class="pf-c-card__body">${this.renderModeSelector()}</div>
+                <div class="pf-c-card__footer">${this.renderSettings()}</div>
+            </div>
+            <ak-text-input
+                name="accessTokenValidity"
+                value=${first(this.instance?.accessTokenValidity, "hours=24")}
+                label=${msg("Token validity")}
+                help=${msg("Configure how long tokens are valid for.")}
+            ></ak-text-input>
+
+            <ak-form-group>
+                <span slot="header">${msg("Advanced protocol settings")}</span>
+                <div slot="body" class="pf-c-form">
+                    <ak-form-element-horizontal label=${msg("Certificate")} name="certificate">
+                        <ak-crypto-certificate-search
+                            certificate=${ifDefined(this.instance?.certificate ?? undefined)}
+                        ></ak-crypto-certificate-search>
+                    </ak-form-element-horizontal>
+                    <ak-form-element-horizontal
+                        label=${msg("Additional scopes")}
+                        name="propertyMappings"
+                    >
+                        <select class="pf-c-form-control" multiple>
+                            ${this.propertyMappings?.results
+                                .filter((scope) => {
+                                    return !scope.managed?.startsWith("goauthentik.io/providers");
+                                })
+                                .map((scope) => {
+                                    const selected = (this.instance?.propertyMappings || []).some(
+                                        (su) => {
+                                            return su == scope.pk;
+                                        },
+                                    );
+                                    return html`<option
+                                        value=${ifDefined(scope.pk)}
+                                        ?selected=${selected}
+                                    >
+                                        ${scope.name}
+                                    </option>`;
+                                })}
+                        </select>
+                        <p class="pf-c-form__helper-text">
+                            ${msg("Additional scope mappings, which are passed to the proxy.")}
+                        </p>
+                        <p class="pf-c-form__helper-text">
+                            ${msg("Hold control/command to select multiple items.")}
+                        </p>
+                    </ak-form-element-horizontal>
+                    <ak-textarea-input
+                        name="skipPathRegex"
+                        label=${this.mode === ProxyMode.ForwardDomain
+                            ? msg("Unauthenticated URLs")
+                            : msg("Unauthenticated Paths")}
+                        value=${ifDefined(this.instance?.skipPathRegex)}
+                        .bighelp=${html` <p class="pf-c-form__helper-text">
+                                ${msg(
+                                    "Regular expressions for which authentication is not required. Each new line is interpreted as a new expression.",
+                                )}
+                            </p>
+                            <p class="pf-c-form__helper-text">
+                                ${msg(
+                                    "When using proxy or forward auth (single application) mode, the requested URL Path is checked against the regular expressions. When using forward auth (domain mode), the full requested URL including scheme and host is matched against the regular expressions.",
+                                )}
+                            </p>`}
+                    >
+                    </ak-textarea-input>
+                </div>
+            </ak-form-group>
+            <ak-form-group>
+                <span slot="header">${msg("Authentication settings")}</span>
+                <div slot="body" class="pf-c-form">
+                    <ak-switch-input
+                        name="interceptHeaderAuth"
+                        ?checked=${first(this.instance?.interceptHeaderAuth, true)}
+                        label=${msg("Intercept header authentication")}
+                        help=${msg(
+                            "When enabled, authentik will intercept the Authorization header to authenticate the request.",
+                        )}
+                    ></ak-switch-input>
+
+                    <ak-switch-input
+                        name="basicAuthEnabled"
+                        ?checked=${first(this.instance?.basicAuthEnabled, false)}
+                        @change=${(ev: Event) => {
+                            const el = ev.target as HTMLInputElement;
+                            this.showHttpBasic = el.checked;
+                        }}
+                        label=${msg("Send HTTP-Basic Authentication")}
+                        help=${msg(
+                            "Send a custom HTTP-Basic Authentication header based on values from authentik.",
+                        )}
+                    ></ak-switch-input>
+
+                    ${this.showHttpBasic ? this.renderHttpBasic() : html``}
+
+                    <ak-form-element-horizontal
+                        label=${msg("Trusted OIDC Sources")}
+                        name="jwksSources"
+                    >
+                        <select class="pf-c-form-control" multiple>
+                            ${this.oauthSources?.results.map((source) => {
+                                const selected = (this.instance?.jwksSources || []).some((su) => {
+                                    return su == source.pk;
+                                });
+                                return html`<option value=${source.pk} ?selected=${selected}>
+                                    ${source.name} (${source.slug})
+                                </option>`;
+                            })}
+                        </select>
+                        <p class="pf-c-form__helper-text">
+                            ${msg(
+                                "JWTs signed by certificates configured in the selected sources can be used to authenticate to this provider.",
+                            )}
+                        </p>
+                        <p class="pf-c-form__helper-text">
+                            ${msg("Hold control/command to select multiple items.")}
+                        </p>
+                    </ak-form-element-horizontal>
+                </div>
+            </ak-form-group>
+        </form>`;
+    }
+}
+
+export default AkTypeProxyApplicationWizardPage;
diff --git a/web/src/admin/applications/wizard/stories/ak-application-wizard.stories.ts b/web/src/admin/applications/wizard/stories/ak-application-wizard.stories.ts
index e1f5e71ae..203aded62 100644
--- a/web/src/admin/applications/wizard/stories/ak-application-wizard.stories.ts
+++ b/web/src/admin/applications/wizard/stories/ak-application-wizard.stories.ts
@@ -7,6 +7,7 @@ import AkApplicationWizardApplicationDetails from "../ak-application-wizard-appl
 import "../ak-application-wizard-authentication-method-choice";
 import "../ak-application-wizard-context";
 import "../ldap/ak-application-wizard-authentication-by-ldap";
+import "../proxy/ak-application-wizard-authentication-by-proxy";
 import "../oauth/ak-application-wizard-authentication-by-oauth";
 import "./ak-application-context-display-for-test";
 import {
@@ -141,3 +142,13 @@ export const PageThreeOauth2 = () => {
         </ak-application-wizard-context>`,
     );
 };
+
+export const PageThreeProxy = () => {
+    return container(
+        html`<ak-application-wizard-context>
+            <ak-application-wizard-authentication-by-proxy></ak-application-wizard-authentication-by-proxy>
+            <hr />
+            <ak-application-context-display-for-test></ak-application-context-display-for-test>
+        </ak-application-wizard-context>`,
+    );
+};
diff --git a/web/src/admin/providers/oauth2/OAuth2ProviderForm.ts b/web/src/admin/providers/oauth2/OAuth2ProviderForm.ts
index 0aac39deb..a8d2f64f6 100644
--- a/web/src/admin/providers/oauth2/OAuth2ProviderForm.ts
+++ b/web/src/admin/providers/oauth2/OAuth2ProviderForm.ts
@@ -13,7 +13,7 @@ import "@goauthentik/elements/forms/SearchSelect";
 import "@goauthentik/elements/utils/TimeDeltaHelp";
 
 import { msg } from "@lit/localize";
-import { TemplateResult, html, nothing } from "lit";
+import { TemplateResult, html } from "lit";
 import { customElement, state } from "lit/decorators.js";
 import { ifDefined } from "lit/directives/if-defined.js";