diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..ce93893
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,10 @@
+To run the dashboard locally:
+
+- Copy `config.yaml.example` to `config.yaml`
+- run `python3 server.py`
+
+# Authorization
+
+There is an example config for testing against https://mfa-dev.apache.org .
+
+If you want to test with different authorizations than your own, you can either patch the code accordingly or start a local oauth server (e.g. [mock-oauth2-server](https://github.com/navikt/mock-oauth2-server), `JSON_CONFIG_PATH=./mock-oauth2-server-config.json nix run git+https://codeberg.org/raboof/mock-oauth2-server?ref=nix --no-write-lock-file`)
diff --git a/app/__init__.py b/app/__init__.py
index c4e13b9..f814f12 100644
--- a/app/__init__.py
+++ b/app/__init__.py
@@ -213,6 +213,19 @@ async def add_security_headers(response: quart.Response) -> quart.Response:
         response.headers.setdefault("Referrer-Policy", "strict-origin-when-cross-origin")
         return response
 
+def _configure_oauth_server(app_config: AppConfig) -> None:
+    """Point asfquart's OAuth flow at the configured OIDC server."""
+    import asfquart.generics
+    asfquart.generics.OAUTH_URL_INIT = (
+        f"{app_config.oauth_url_init}?state=%s&redirect_uri=%s"
+    )
+    asfquart.generics.OAUTH_URL_CALLBACK = app_config.oauth_url_callback
+    asfquart.generics.OAUTH_ENFORCE_HTTPS = app_config.oauth_enforce_https
+    asfquart.generics.OAUTH_CLIENT_ID = app_config.oauth_client_id
+    asfquart.generics.OAUTH_CLIENT_SECRET = app_config.oauth_client_secret
+    asfquart.generics.OAUTH_URL_LOGOUT = app_config.oauth_url_logout
+    asfquart.generics.OAUTH_ISSUER = app_config.oauth_issuer
+
 def create_app(test_environment: bool = False) -> asfquart.base.QuartApp:
     from app import config
     app_dir = None
@@ -233,6 +246,8 @@ def create_app(test_environment: bool = False) -> asfquart.base.QuartApp:
 
     quart_app = asfquart.construct("security-dashboard", app_dir, cfg_file, token_file)
 
+    _configure_oauth_server(app_config)
+
     config.setup_app_config(quart_app, app_config)
 
     _register_routes(quart_app)
diff --git a/app/config.py b/app/config.py
index b620d51..3289ee1 100644
--- a/app/config.py
+++ b/app/config.py
@@ -56,6 +56,20 @@ class AppConfig(pydantic.BaseModel):
     pmcs_in_attic: list[str] = []
     """PMCs retired to the Attic, whose reports the security team handles directly"""
 
+    oauth_url_init: str = "https://oauth.apache.org/auth-oidc"
+    """URL of the ASF OIDC/OAuth server."""
+
+    oauth_url_callback: str = "https://oauth.apache.org/token-oidc"
+    """URL of the ASF OIDC/OAuth server token endpoint."""
+
+    oauth_url_logout: str = None;
+    oauth_client_id: str = None;
+    oauth_client_secret: str = None;
+    oauth_issuer: str = None;
+
+    oauth_enforce_https: bool = True
+    """enforce HTTPS in the callback to the relying party."""
+
     server: ServerConfig = ServerConfig()
 
     @property
diff --git a/config.yaml.example b/config.yaml.example
index 85b60bd..66fe215 100644
--- a/config.yaml.example
+++ b/config.yaml.example
@@ -106,3 +106,20 @@ pmcs_in_attic:
   - wink
   - wookie
   - xmlbeans
+
+# for local testing with mock-oauth2-server
+#oauth_url_init: http://localhost:8080/default/authorize
+#oauth_client_id: example-app
+#oauth_client_secret: ZXhhbXBsZS1hcHAtc2VjcmV0
+#oauth_url_callback: http://localhost:8080/default/token
+#oauth_issuer: http://localhost:8080/default
+#oauth_enforce_https: false
+
+# for local testing with https://mfa-dev.apache.org
+oauth_url_init: https://mfa-dev.apache.org/application/o/authorize/
+oauth_client_id: local_testing.apache.org
+oauth_client_secret: (ask)
+oauth_url_callback: https://mfa-dev.apache.org/application/o/token/
+oauth_url_logout: https://mfa-dev.apache.org/application/o/local_testing-apache-org/end-session/
+oauth_issuer: https://mfa-dev.apache.org/application/o/local_testing-apache-org/
+oauth_enforce_https: false
diff --git a/pyproject.toml b/pyproject.toml
index a866530..d1eb382 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -5,7 +5,8 @@ license = "Apache-2.0"
 
 dependencies = [
   "asfpy[aioldap]",
-  "asfquart~=0.1.12",
+  # https://github.com/apache/infrastructure-asfquart/pull/107
+  "asfquart @ git+https://github.com/raboof/infrastructure-asfquart@oauth-support-client-id-and-secret",
   "hypercorn",
   "pydantic~=2.11",
 ]