---
title: "Authentication settings"
summary: "Settings for how people sign in and how long their sessions last."
description: "Sign-in mode, session lifetimes, and the OIDC provider configuration."
status: preview
generated: true
read_when:
  - "You are moving an instance from local sign-in to an identity provider."
  - "You need to map provider groups onto Fanout roles."
---

Every setting below is read once at startup and requires a restart to change.
Built-in defaults are overridden by nonempty environment values.
Unknown `FANOUT_` names fail startup; platform-injected service names are tolerated.
Vendor credentials and endpoints keep the vendor's documented names.

| Environment variable | Type | Default |
|---|---|---|
| `FANOUT_AUTH_CODE_SECRET` or `FANOUT_AUTH_CODE_SECRET_FILE` | string · secret | — |
| `FANOUT_AUTH_MODE` | string | `local` |
| `FANOUT_OIDC_ADMIN_GROUPS` | string | — |
| `FANOUT_OIDC_ALLOWED_DOMAINS` | string | — |
| `FANOUT_OIDC_ALLOWED_GROUPS` | string | — |
| `FANOUT_OIDC_AUTO_PROVISION` | boolean | `false` |
| `FANOUT_OIDC_CLIENT_ID` | string | — |
| `FANOUT_OIDC_CLIENT_SECRET` or `FANOUT_OIDC_CLIENT_SECRET_FILE` | string · secret | — |
| `FANOUT_OIDC_DEFAULT_ROLE` | string | `viewer` |
| `FANOUT_OIDC_EMAIL_CLAIM` | string | `email` |
| `FANOUT_OIDC_EMAIL_VERIFICATION` | string | `required` |
| `FANOUT_OIDC_ISSUER_URL` | string | — |
| `FANOUT_OIDC_OPERATOR_GROUPS` | string | — |
| `FANOUT_SELF_SIGNUP` | boolean | `false` |
| `FANOUT_SESSION_ABSOLUTE_TTL` | duration | `168h` |
| `FANOUT_SESSION_IDLE_TTL` | duration | `12h` |

## Notes

### `FANOUT_AUTH_CODE_SECRET`

Signs local sign-in codes; required in local mode with at least 32 characters.

### `FANOUT_AUTH_MODE`

Selects local sign-in or oidc; each mode validates its prerequisites.

### `FANOUT_OIDC_ADMIN_GROUPS`

Lists identity-provider groups mapped to admin, separated by commas.

### `FANOUT_OIDC_ALLOWED_DOMAINS`

Lists allowed email domains, separated by commas; wildcard * requires verified email.

### `FANOUT_OIDC_ALLOWED_GROUPS`

Lists allowed identity-provider groups, separated by commas.

### `FANOUT_OIDC_AUTO_PROVISION`

Creates accounts on OIDC sign-in; requires an allowed group or domain.

### `FANOUT_OIDC_CLIENT_ID`

Identifies Fanout's client registration; required in OIDC mode.

### `FANOUT_OIDC_CLIENT_SECRET`

Authenticates Fanout's client registration; required in OIDC mode.

### `FANOUT_OIDC_DEFAULT_ROLE`

Assigns viewer, operator, or admin to users without a group role mapping.

### `FANOUT_OIDC_EMAIL_CLAIM`

Names the claim containing the user's email address.

### `FANOUT_OIDC_EMAIL_VERIFICATION`

Selects required verified-email claims or issuer trust; issuer trust requires an allowlist.

### `FANOUT_OIDC_ISSUER_URL`

Selects the identity provider issuer; required in OIDC mode.

### `FANOUT_OIDC_OPERATOR_GROUPS`

Lists identity-provider groups mapped to operator, separated by commas.

### `FANOUT_SELF_SIGNUP`

Allows verified email addresses to create viewer accounts; requires local auth and SMTP.

### `FANOUT_SESSION_ABSOLUTE_TTL`

Limits total session lifetime; it must be at least FANOUT_SESSION_IDLE_TTL.

### `FANOUT_SESSION_IDLE_TTL`

Expires inactive sessions; use a Go duration of at least 5m.

> **Secrets**
>
> Settings marked `secret` are redacted from Fanout's startup configuration
> log. Supply either the value or its `_FILE` path, never both. File contents
> lose exactly one trailing newline (LF or CRLF); empty secrets fail startup.