diff --git a/kube/go/auth-proxy/BUILD.bazel b/kube/go/auth-proxy/BUILD.bazel
index fdcced4..2862a51 100644
--- a/kube/go/auth-proxy/BUILD.bazel
+++ b/kube/go/auth-proxy/BUILD.bazel
@@ -12,6 +12,7 @@
         "//go/httputils",
         "//go/sklog",
         "//kube/go/auth-proxy/auth",
+        "@org_golang_x_oauth2//google",
     ],
 )
 
diff --git a/kube/go/auth-proxy/main.go b/kube/go/auth-proxy/main.go
index e50050f..0ee4c04 100644
--- a/kube/go/auth-proxy/main.go
+++ b/kube/go/auth-proxy/main.go
@@ -1,8 +1,30 @@
-// Prometheus doesn't handle authentication, so use a reverse
-// proxy that requires login to protect it.
+// auth-proxy is a reverse proxy that runs in front of applications and takes
+// care of authentication.
+//
+// This is useful for applications like Promentheus that doesn't handle
+// authentication itself, so we can run it behind auth-proxy to restrict access.
+//
+// The auth-proxy application also adds the X-WEBAUTH-USER header to each
+// authenticated request and gives it the value of the logged in users email
+// address, which can be used for audit logging. The application running behind
+// auth-proxy should then use:
+//
+//     https://pkg.go.dev/go.skia.org/infra/go/alogin/proxylogin
+//
+// When using --cria_group this application should be run using work-load
+// identity with a service account that as read access to CRIA, such as:
+//
+//     skia-auth-proxy-cria-reader@skia-public.iam.gserviceaccount.com
+//
+// See also:
+//
+//     https://chrome-infra-auth.appspot.com/auth/groups/project-skia-auth-service-access
+//
+//     https://grafana.com/blog/2015/12/07/grafana-authproxy-have-it-your-way/
 package main
 
 import (
+	"context"
 	"flag"
 	"fmt"
 	"net/http"
@@ -15,15 +37,17 @@
 	"go.skia.org/infra/go/httputils"
 	"go.skia.org/infra/go/sklog"
 	"go.skia.org/infra/kube/go/auth-proxy/auth"
+	"golang.org/x/oauth2/google"
 )
 
 var (
+	criaGroup   = flag.String("cria_group", "", "The chrome infra auth group to use for restricting access. Example: 'google/skia-staff@google.com'")
 	local       = flag.Bool("local", false, "Running locally if true. As opposed to in production.")
 	port        = flag.String("port", ":8000", "HTTP service address (e.g., ':8000')")
 	promPort    = flag.String("prom_port", ":20000", "Metrics service address (e.g., ':10110')")
 	targetPort  = flag.String("target_port", ":9000", "The port we are proxying to.")
 	allowPost   = flag.Bool("allow_post", false, "Allow POST requests to bypass auth.")
-	allowedFrom = flag.String("allowed_from", "google.com", "A comma separated list of of domains and email addresses that are allowed to access the site.")
+	allowedFrom = flag.String("allowed_from", "", "A comma separated list of of domains and email addresses that are allowed to access the site. Example: 'google.com'")
 	passive     = flag.Bool("passive", false, "If true then allow unauthenticated requests to go through, while still adding logged in users emails in via the webAuthHeaderName.")
 )
 
@@ -67,6 +91,17 @@
 	p.reverseProxy.ServeHTTP(w, r)
 }
 
+func validateFlags() error {
+	if *criaGroup != "" && *allowedFrom != "" {
+		return fmt.Errorf("Only one of the flags in [--auth_group, --allowed_from] can be specified.")
+	}
+	if *criaGroup == "" && *allowedFrom == "" {
+		return fmt.Errorf("At least one of the flags in [--auth_group, --allowed_from] must be specified.")
+	}
+
+	return nil
+}
+
 func main() {
 	common.InitWithMust(
 		"auth-proxy",
@@ -74,9 +109,28 @@
 		common.MetricsLoggingOpt(),
 	)
 
-	allowedList := strings.Split(*allowedFrom, ",")
+	if err := validateFlags(); err != nil {
+		sklog.Fatal(err)
+	}
+
+	var allow allowed.Allow
+	if *criaGroup != "" {
+		ctx := context.Background()
+		ts, err := google.DefaultTokenSource(ctx, "email")
+		if err != nil {
+			sklog.Fatal(err)
+		}
+		criaClient := httputils.DefaultClientConfig().WithTokenSource(ts).With2xxOnly().Client()
+		allow, err = allowed.NewAllowedFromChromeInfraAuth(criaClient, *criaGroup)
+		if err != nil {
+			sklog.Fatal(err)
+		}
+	} else {
+		allow = allowed.NewAllowedFromList(strings.Split(*allowedFrom, ","))
+	}
+
 	authInstance := auth.New()
-	authInstance.SimpleInitWithAllow(*port, *local, nil, nil, allowed.NewAllowedFromList(allowedList))
+	authInstance.SimpleInitWithAllow(*port, *local, nil, nil, allow)
 	targetURL := fmt.Sprintf("http://localhost%s", *targetPort)
 	target, err := url.Parse(targetURL)
 	if err != nil {
diff --git a/kube/go/auth-proxy/main_test.go b/kube/go/auth-proxy/main_test.go
index 05521a0..1ea54c2 100644
--- a/kube/go/auth-proxy/main_test.go
+++ b/kube/go/auth-proxy/main_test.go
@@ -156,3 +156,32 @@
 	require.True(t, *called)
 	authMock.AssertExpectations(t)
 }
+
+func TestValidateFlags_BothFlagsSpecified_ReturnsError(t *testing.T) {
+	unittest.SmallTest(t)
+	*criaGroup = "project-angle-committers"
+	*allowedFrom = "google.com"
+
+	require.Error(t, validateFlags())
+}
+
+func TestValidateFlags_NeitherFlagIsSpecified_ReturnsError(t *testing.T) {
+	unittest.SmallTest(t)
+	*criaGroup = ""
+	*allowedFrom = ""
+
+	require.Error(t, validateFlags())
+}
+
+func TestValidateFlags_OnlyOneFlagIsSpecified_ReturnsNoError(t *testing.T) {
+	unittest.SmallTest(t)
+	*criaGroup = "project-angle-committers"
+	*allowedFrom = ""
+
+	require.NoError(t, validateFlags())
+
+	*criaGroup = ""
+	*allowedFrom = "google.com"
+
+	require.NoError(t, validateFlags())
+}