Global Configuration
General authentication configuration in Portabase.
These variables control the general authentication behavior and account security on your Portabase instance.
General Settings
Prop
Type
If you disable AUTH_EMAIL_PASSWORD_ENABLED, make sure you have configured at least one functional OAuth2 or OIDC provider, otherwise you might lose access to your instance.
Account Linking
These variables control how a Portabase account is associated with an OAuth2 or OIDC provider. They apply to every configured provider.
Prop
Type
Keep AUTH_ALLOW_UNLINKING at false when the provider is the only way into an account: with AUTH_EMAIL_PASSWORD_ENABLED disabled and no passkey registered, a user who unlinks their last provider locks themselves out.
Configure with the CLI
If the dashboard was created with the Portabase CLI, change these settings with portabase dashboard set instead of editing .env, then restart:
portabase dashboard set ./my-dashboard signup false passkey true
portabase dashboard set ./my-dashboard account_linking false account_unlinking false
portabase dashboard set ./my-dashboard trusted_domains "backup.example.com"
portabase restart ./my-dashboard| Variable | CLI key |
|---|---|
AUTH_EMAIL_PASSWORD_ENABLED | password_auth |
AUTH_SIGNUP_ENABLED | signup |
AUTH_PASSKEY_ENABLED | passkey |
AUTH_SYNC_OIDC_ROLES_ON_LOGIN | sync_oidc_roles |
TRUSTED_DOMAINS | trusted_domains |
AUTH_ALLOW_LINKING | account_linking |
AUTH_ALLOW_UNLINKING | account_unlinking |
Use portabase dashboard unset to go back to the default value, and portabase dashboard show to check the current configuration.
The CLI refuses password_auth false while no OIDC or OAuth2 provider is configured.
Security Recommendations
- Passkeys: We recommend enabling
AUTH_PASSKEY_ENABLEDto provide a more secure and smooth login experience. - Registration: For a private instance, set
AUTH_SIGNUP_ENABLEDtofalseafter creating your administrator accounts. - Account linking: On a shared instance, set
AUTH_ALLOW_LINKINGtofalseunless your provider verifies email addresses. A provider that returns an unverified address could otherwise be used to take over an existing account with the same email.
Last updated on