Authentication

AUTH_DISABLED=1 (the default in .env.example) bypasses authentication — use it only on trusted networks. For production, set AUTH_DISABLED=0 and choose one of:

OIDC

Point OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET and OIDC_AUDIENCE at your OAuth server. Tokens may be signed with EdDSA, RS256 or ES256 (see OIDC_SIGNING_ALGS). The login asks for offline_access; the refresh token stays server-side.

Auth Service is the reference identity provider — see LLM providers for the application setup.

Static bearer token

Set API_TOKEN (generate one with openssl rand -hex 32) and send it as Authorization: Bearer <token>. It identifies a machine, not a user, so it cannot run work billed to a user.

Secrets at rest

Keys saved from the UI are encrypted with Fernet. Set SETTINGS_SECRET_KEY (openssl rand -base64 32); without it the key is ephemeral and stored secrets are lost on restart.