Basic Configuration:
General
For a quick overview, refer to the user guide provided here: Authentication
Here’s an overview of the general configuration.
| Key | Type | Description | Example |
|---|---|---|---|
| ALLOW_EMAIL_LOGIN | boolean | Enable or disable ONLY email login. | ALLOW_EMAIL_LOGIN=true |
| ALLOW_REGISTRATION | boolean | Enable or disable Email registration of new users. | ALLOW_REGISTRATION=true |
| ALLOW_SOCIAL_LOGIN | boolean | Allow users to connect to LibreChat with various social networks. | ALLOW_SOCIAL_LOGIN=false |
| ALLOW_SOCIAL_REGISTRATION | boolean | Enable or disable registration of new users using various social networks. | ALLOW_SOCIAL_REGISTRATION=false |
Note: OpenID does not support the ability to disable only registration.
Quick Tip: Even with registration disabled, add users directly to the database using
npm run create-user. If you can’t get npm to work, trysudo docker exec -ti LibreChat shfirst to “ssh” into the container. Quick Tip: To delete a user, you can rundocker-compose exec api npm run delete-user email@domain.com
Session Expiry and Refresh Token
- Default values: session expiry: 15 minutes, refresh token expiry: 7 days
- For more information: GitHub PR #927 - Refresh Token
| Key | Type | Description | Example |
|---|---|---|---|
| SESSION_EXPIRY | integer (milliseconds) | Session expiry time. | SESSION_EXPIRY=1000 * 60 * 15 |
| REFRESH_TOKEN_EXPIRY | integer (milliseconds) | Refresh token expiry time. | REFRESH_TOKEN_EXPIRY=(1000 * 60 * 60 * 24) * 7 |
JWT Secret and Refresh Secret
- You should use new secure values. The examples given are 32-byte keys (64 characters in hex).
- Use this replit to generate some quickly: JWT Keys
| Key | Type | Description | Example |
|---|---|---|---|
| JWT_SECRET | string (hex) | JWT secret key. | JWT_SECRET=16f8c0ef4a5d391b26034086c628469d3f9f497f08163ab9b40137092f2909ef |
| JWT_REFRESH_SECRET | string (hex) | JWT refresh secret key. | JWT_REFRESH_SECRET=eaa5191f2914e30b9387fd84e254e4ba6fc51b4654968a9b0803b456a54b8418 |
Automated Moderation System (optional)
The Automated Moderation System is enabled by default. It uses a scoring mechanism to track user violations. As users commit actions like excessive logins, registrations, or messaging, they accumulate violation scores. Upon reaching a set threshold, the user and their IP are temporarily banned. This system ensures platform security by monitoring and penalizing rapid or suspicious activities.
To set up the mod system, review the setup guide.
Please Note: If you want this to work in development mode, you will need to create a file called
.env.developmentin the root directory and setDOMAIN_CLIENTtohttp://localhost:3090or whatever port is provided by vite when runnningnpm run frontend-dev