Authentication settings

Every setting below is read once at startup and requires a restart to change. Built-in defaults are overridden by nonempty environment values. Unknown FANOUT_ names fail startup; platform-injected service names are tolerated. Custom names use FANOUT_ plus a clear name, adding the area only when it clarifies. Vendor credentials and endpoints keep the vendor’s documented names.

Environment variable	Type	Default
`FANOUT_AUTH_CODE_SECRET` or `FANOUT_AUTH_CODE_SECRET_FILE`	string · secret	—
`FANOUT_AUTH_MODE`	string	`local`
`FANOUT_OIDC_ADMIN_GROUPS`	string	—
`FANOUT_OIDC_ALLOWED_DOMAINS`	string	—
`FANOUT_OIDC_ALLOWED_GROUPS`	string	—
`FANOUT_OIDC_AUTO_PROVISION`	boolean	`false`
`FANOUT_OIDC_CLIENT_ID`	string	—
`FANOUT_OIDC_CLIENT_SECRET` or `FANOUT_OIDC_CLIENT_SECRET_FILE`	string · secret	—
`FANOUT_OIDC_DEFAULT_ROLE`	string	`viewer`
`FANOUT_OIDC_EMAIL_CLAIM`	string	`email`
`FANOUT_OIDC_EMAIL_VERIFICATION`	string	`required`
`FANOUT_OIDC_ISSUER_URL`	string	—
`FANOUT_OIDC_OPERATOR_GROUPS`	string	—
`FANOUT_SELF_SIGNUP`	boolean	`false`
`FANOUT_SESSION_ABSOLUTE_TTL`	duration	`168h`
`FANOUT_SESSION_IDLE_TTL`	duration	`12h`

Notes

`FANOUT_AUTH_CODE_SECRET`

Signs local sign-in codes; required in local mode with at least 32 characters.

`FANOUT_AUTH_MODE`

Selects local sign-in or oidc; each mode validates its prerequisites.

`FANOUT_OIDC_ADMIN_GROUPS`

Lists identity-provider groups mapped to admin, separated by commas.

`FANOUT_OIDC_ALLOWED_DOMAINS`

Lists allowed email domains, separated by commas; wildcard * requires verified email.

`FANOUT_OIDC_ALLOWED_GROUPS`

Lists allowed identity-provider groups, separated by commas.

`FANOUT_OIDC_AUTO_PROVISION`

Creates accounts on OIDC sign-in; requires an allowed group or domain.

`FANOUT_OIDC_CLIENT_ID`

Identifies Fanout’s client registration; required in OIDC mode.

`FANOUT_OIDC_CLIENT_SECRET`

Authenticates Fanout’s client registration; required in OIDC mode.

`FANOUT_OIDC_DEFAULT_ROLE`

Assigns viewer, operator, or admin to users without a group role mapping.

`FANOUT_OIDC_EMAIL_CLAIM`

Names the claim containing the user’s email address.

`FANOUT_OIDC_EMAIL_VERIFICATION`

Selects required verified-email claims or issuer trust; issuer trust requires an allowlist.

`FANOUT_OIDC_ISSUER_URL`

Selects the identity provider issuer; required in OIDC mode.

`FANOUT_OIDC_OPERATOR_GROUPS`

Lists identity-provider groups mapped to operator, separated by commas.

`FANOUT_SELF_SIGNUP`

Allows verified email addresses to create viewer accounts; requires local auth and SMTP.

`FANOUT_SESSION_ABSOLUTE_TTL`

Limits total session lifetime; it must be at least FANOUT_SESSION_IDLE_TTL.

`FANOUT_SESSION_IDLE_TTL`

Expires inactive sessions; use a Go duration of at least 5m.