Authentication

Email & Password

Enabled by default. Users sign up with email and password. Passwords are hashed with bcrypt. No additional configuration required.

OAuth Providers

Add social login by configuring OAuth providers. Each provider needs credentials from the provider's developer console.

GitHub OAuth

AUTH_GITHUB_ID=your-github-client-id
AUTH_GITHUB_SECRET=your-github-client-secret

Create OAuth App at github.com/settings/developers. Set callback URL to https://your-domain.com/api/auth/callback/github.

Google OAuth

AUTH_GOOGLE_ID=your-google-client-id
AUTH_GOOGLE_SECRET=your-google-client-secret

Create credentials at Google Cloud Console. Authorized redirect URI: https://your-domain.com/api/auth/callback/google.

SAML SSO (Enterprise)

SAML 2.0 SSO integrates with enterprise identity providers like Okta, Azure AD, and OneLogin. Requires the ENCRYPTION_MASTER_KEY env var for secure key storage.

Configuration is done through the admin settings UI. You provide:

• Identity Provider (IdP) metadata URL or XML
• IdP certificate
• Attribute mappings (email, name, groups)

API Keys

Generate API keys for programmatic access to the chat and document APIs. Keys are created in the user settings and support scope restrictions.

curl -X POST https://your-domain.com/api/chat \
  -H "Authorization: Bearer sk-your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"message": "Hello"}'

Session Management

Sessions use JWT tokens stored in HTTP-only cookies. Configuration:

• NEXTAUTH_SECRET — Signs and encrypts session cookies (min 32 chars)
• NEXTAUTH_URL— Your app's public URL for cookie domain and redirects
• Sessions include fingerprinting to prevent session hijacking
• CSRF protection is enabled by default with double-submit cookies