Skip to content

LAM-1778: Fix stale self-hosted access control docs (Better Auth) #175

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
laminar-coding-agent wants to merge 1 commit into
base: main
Choose a base branch
from
Open

LAM-1778: Fix stale self-hosted access control docs (Better Auth) #175

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 8 additions & 10 deletions hosting-options.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,20 +58,18 @@ For production self-hosting options, see the [GitHub repository](https://github.

### Access control

By default, any user can access your self-hosted instance. To restrict access to specific GitHub users, enable GitHub OAuth:
By default, a self-hosted instance accepts sign-in from anyone who can reach it. To require users to authenticate through an OAuth provider, set that provider's credentials. GitHub and Google are configured directly:

```bash
AUTH_GITHUB_ID=your_github_oauth_app_id
AUTH_GITHUB_SECRET=your_github_oauth_app_secret

AUTH_GOOGLE_ID=your_google_oauth_client_id
AUTH_GOOGLE_SECRET=your_google_oauth_client_secret
```

Then create an `allowed-emails.json` file in your project root:
Enterprise SSO providers (Azure Entra ID, Okta, Keycloak) are also supported through their own `AUTH_*` variables.

```json
{
"emails": [
"user1@example.com",
"user2@example.com"
]
}
```
<Note>
Configuring a provider controls *how* users sign in, not *who* can sign in: anyone with an account at that provider can still create an account on your instance. There is no built-in email allow-list.
</Note>