--- title: Authentication and SSO (self-hosted) description: "Configure SSO (SAML, OIDC) and authentication for self-hosted Langfuse. Supports Google, GitHub, Azure AD, Okta, and custom OIDC/SAML providers." label: "Version: v4" sidebarTitle: "Authentication and SSO" --- # Authentication and SSO (self-hosted) Langfuse supports both email/password and SSO authentication for self-hosted instances. Make sure that `NEXTAUTH_URL` environment variable is [configured correctly](/self-hosting/configuration) if you want to use any authentication method other than email/password. If you use Langfuse Cloud, please refer to the [Cloud Authentication and SSO](/docs/administration/authentication-and-sso) documentation. ## Email/Password [#auth-email-password] Email/password authentication is enabled by default. Users can sign up and log in using their email and password. ### Password Reset **If [transactional emails](/self-hosting/configuration/transactional-emails) are configured** on your instance, users can reset their password by using the "Forgot password" link on the login page. **If transactional emails are not set up**, passwords can be reset by following these steps: 1. Update the email associated with your user account in database, such as by adding a prefix. 2. You can then sign up again with a new password. 3. Reassign any organizations you were associated with via the `organization_memberships` table in database. 4. Finally, remove the old user account from the `users` table in database. ### Disable email/password authentication to use SSO To disable email/password authentication, set `AUTH_DISABLE_USERNAME_PASSWORD=true`. In this case, you need to set up [SSO](#sso) instead. If you decide to switch from email/password to SSO on a running instance, you can enable `AUTH__ALLOW_ACCOUNT_LINKING=true` on the SSO provider. This will automatically merge accounts with the same email address. ### Email verification on signup [#email-verification-on-signup] Set `AUTH_EMAIL_VERIFICATION_REQUIRED=true` to require new users to verify their email address via a one-time password (OTP) before they can set their password during email/password signup. This requires [transactional emails](/self-hosting/configuration/transactional-emails) to be configured. When enabled, the signup flow becomes: 1. User enters their email and name on the sign-up page. 2. User receives an OTP via email and enters it to verify the address. 3. User sets a password on `/auth/setup-password` and is signed in. Notes: - SSO sign-in is unaffected by this setting. - When this flag is on, direct calls to `POST /api/auth/signup` return `403`; signups must go through the OTP flow. - If a user abandons the flow after verification, signing up again re-sends the OTP, and they can also complete the flow via the password reset page. ### Creation of default user If you want to programmatically create a default user, check out the [Headless Initialization](/self-hosting/administration/headless-initialization) documentation. This is useful if you want to initialize the instance without using the UI, e.g. when running Langfuse in a CI/CD pipeline or programmatically deploying Langfuse into many environments. ## SSO To enable OAuth/SSO provider sign-in for Langfuse, configure the required environment variables for the provider. Use `AUTH__ALLOW_ACCOUNT_LINKING` to allow merging accounts with the same email address. This is useful when users sign in with different providers or email/password but have the same email address. You need to be careful with this setting as it can lead to security issues if the emails are not verified. Need another provider? Langfuse uses Auth.js, which integrates with [many providers](https://next-auth.js.org/providers/). Add a [feature request on GitHub](/ideas) if you want us to add support for a specific provider. ### Auth0 [NextAuth Auth0 Provider Docs](https://next-auth.js.org/providers/auth0) | Configuration | Value | | ------------------ | ----------------------------------------------------------------------------- | | Required Variables | `AUTH_AUTH0_CLIENT_ID`
`AUTH_AUTH0_CLIENT_SECRET`
`AUTH_AUTH0_ISSUER` | | Optional Variables | See [additional configuration](#additional-configuration) section below. | | OAuth Redirect URL | `/api/auth/callback/auth0` | Provider: `AUTH0` ### Authentik [NextAuth Authentik Provider Docs](https://next-auth.js.org/providers/authentik) | Configuration | Value | | ------------------ | -------------------------------------------------------------------------------------------------------------------- | | Required Variables | `AUTH_AUTHENTIK_CLIENT_ID`
`AUTH_AUTHENTIK_CLIENT_SECRET`
`AUTH_AUTHENTIK_ISSUER` | | Optional Variables | `AUTH_AUTHENTIK_AUTHORIZATION_URL`

See [additional configuration](#additional-configuration) section below. | | OAuth Redirect URL | `/api/auth/callback/authentik` | Provider: `AUTHENTIK` Notes: - The `AUTH_AUTHENTIK_ISSUER` must be in the format `https:///application/o/` with an optional trailing slash. - **Authorization URL override:** Set `AUTH_AUTHENTIK_AUTHORIZATION_URL` to a browser-reachable Authentik URL when your Authentik instance uses a different internal vs. external URL (e.g., split-DNS or reverse proxy setups). The issuer URL will still be used for server-side token, userinfo, and JWKS validation, while the authorization URL override is used for browser redirects only. ### AWS Cognito [NextAuth Cognito Provider Docs](https://next-auth.js.org/providers/cognito) | Configuration | Value | | ------------------ | ----------------------------------------------------------------------------------- | | Required Variables | `AUTH_COGNITO_CLIENT_ID`
`AUTH_COGNITO_CLIENT_SECRET`
`AUTH_COGNITO_ISSUER` | | Optional Variables | See [additional configuration](#additional-configuration) section below. | | OAuth Redirect URL | `/api/auth/callback/cognito` | Provider: `COGNITO` ### Azure AD/Entra ID [NextAuth Azure AD Provider Docs](https://next-auth.js.org/providers/azure-ad) | Configuration | Value | | ------------------ | ----------------------------------------------------------------------------------------- | | Required Variables | `AUTH_AZURE_AD_CLIENT_ID`
`AUTH_AZURE_AD_CLIENT_SECRET`
`AUTH_AZURE_AD_TENANT_ID` | | Optional Variables | See [additional configuration](#additional-configuration) section below. | | OAuth Redirect URL | `/api/auth/callback/azure-ad` | Provider: `AZURE_AD` Notes: - [#4764](https://github.com/orgs/langfuse/discussions/4764): Langfuse uses email to identify users. Thus, you need to add the `email` claim in the token configuration and all users must have an `Email` in their user profile. - `AUTH_AZURE_AD_CLIENT_SECRET` needs to be the Client Secret `value`, not the `Secret ID`. ### GitHub [NextAuth GitHub Provider Docs](https://next-auth.js.org/providers/github) | Configuration | Value | | ------------------ | ------------------------------------------------------------------------ | | Required Variables | `AUTH_GITHUB_CLIENT_ID`
`AUTH_GITHUB_CLIENT_SECRET` | | Optional Variables | See [additional configuration](#additional-configuration) section below. | | OAuth Redirect URL | `/api/auth/callback/github` | Provider: `GITHUB` ### GitHub Enterprise | Configuration | Value | | ------------------ | ------------------------------------------------------------------------------------------------------------------- | | Required Variables | `AUTH_GITHUB_ENTERPRISE_CLIENT_ID`
`AUTH_GITHUB_ENTERPRISE_CLIENT_SECRET`
`AUTH_GITHUB_ENTERPRISE_BASE_URL` | | Optional Variables | See [additional configuration](#additional-configuration) section below. | | OAuth Redirect URL | `/api/auth/callback/github-enterprise` | Provider: `GITHUB_ENTERPRISE` Thanks to [@jay0129](https://github.com/jay0129) for the initial contribution of GitHub Enterprise support! ### GitLab [NextAuth GitLab Provider Docs](https://next-auth.js.org/providers/gitlab) | Configuration | Value | | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Required Variables | `AUTH_GITLAB_CLIENT_ID`
`AUTH_GITLAB_CLIENT_SECRET` | | Optional Variables | `AUTH_GITLAB_ISSUER`
`AUTH_GITLAB_URL` (For custom GitLab instances different from gitlab.com)

See [additional configuration](#additional-configuration) section below for more options. | | OAuth Redirect URL | `/api/auth/callback/gitlab` | Provider: `GITLAB` ### Google [NextAuth Google Provider Docs](https://next-auth.js.org/providers/google) | Configuration | Value | | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Required Variables | `AUTH_GOOGLE_CLIENT_ID`
`AUTH_GOOGLE_CLIENT_SECRET` | | Optional Variables | `AUTH_GOOGLE_ALLOWED_DOMAINS=langfuse.com,google.com` (list of allowed domains based on [`hd` OAuth claim](https://developers.google.com/identity/openid-connect/openid-connect#an-id-tokens-payload))

See [additional configuration](#additional-configuration) section below for more options. | | OAuth Redirect URL | `/api/auth/callback/google` | Provider: `GOOGLE` ### Keycloak [NextAuth Keycloak Provider Docs](https://next-auth.js.org/providers/keycloak) | Configuration | Value | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Required Variables | `AUTH_KEYCLOAK_CLIENT_ID`
`AUTH_KEYCLOAK_CLIENT_SECRET`
`AUTH_KEYCLOAK_ISSUER` | | Optional Variables | `AUTH_KEYCLOAK_SCOPE` (defaults to `"openid email profile"`)
`AUTH_KEYCLOAK_ID_TOKEN` (Defaults to `true`, set to `false` if you want to make a request to the `userinfo` endpoint instead of extracting user information from the `id_token` claims)

See [additional configuration](#additional-configuration) section below for more options. | | OAuth Redirect URL | `/api/auth/callback/keycloak` | Provider: `KEYCLOAK` Thanks to [@RTae](https://github.com/RTae) for the initial contribution of Keycloak support! ### JumpCloud | Configuration | Value | | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Required Variables | `AUTH_JUMPCLOUD_CLIENT_ID`
`AUTH_JUMPCLOUD_CLIENT_SECRET`
`AUTH_JUMPCLOUD_ISSUER` | | Optional Variables | `AUTH_JUMPCLOUD_SCOPE` (defaults to `"openid profile email"`)

See [additional configuration](#additional-configuration) section below for more options. | | OAuth Redirect URL | `/api/auth/callback/jumpcloud` | Provider: `JUMPCLOUD` ### Okta [NextAuth Okta Provider Docs](https://next-auth.js.org/providers/okta) | Configuration | Value | | ------------------ | -------------------------------------------------------------------------- | | Required Variables | `AUTH_OKTA_CLIENT_ID`
`AUTH_OKTA_CLIENT_SECRET`
`AUTH_OKTA_ISSUER` | | Optional Variables | See [additional configuration](#additional-configuration) section below. | | OAuth Redirect URL | `/api/auth/callback/okta` | Provider: `OKTA` For automated user provisioning, Okta requires a **second application** for SCIM in addition to the OIDC app used for SSO. See the [Okta SCIM Setup Guide](/docs/administration/scim-and-org-api#okta). Notes: - You might need to add `AUTH_OKTA_CHECKS=pkce,state` depending on your Okta setup. See [additional configuration](#additional-configuration) section below. ### OneLogin [NextAuth OneLogin Provider Docs](https://next-auth.js.org/providers/onelogin) | Configuration | Value | | ------------------ | -------------------------------------------------------------------------------------- | | Required Variables | `AUTH_ONELOGIN_CLIENT_ID`
`AUTH_ONELOGIN_CLIENT_SECRET`
`AUTH_ONELOGIN_ISSUER` | | Optional Variables | See [additional configuration](#additional-configuration) section below. | | OAuth Redirect URL | `/api/auth/callback/onelogin` | Provider: `ONELOGIN` ### WorkOS [NextAuth WorkOS Provider Docs](https://next-auth.js.org/providers/workos) | Configuration | Value | | ------------------ | ------------------------------------------------------------ | | Required Variables | `AUTH_WORKOS_CLIENT_ID`
`AUTH_WORKOS_CLIENT_SECRET` | | Optional Variables | `AUTH_WORKOS_ORGANIZATION_ID` or `AUTH_WORKOS_CONNECTION_ID` | | OAuth Redirect URL | `/api/auth/callback/workos` | Provider: `WORKOS` Notes: - Without specifying `AUTH_WORKOS_ORGANIZATION_ID` or `AUTH_WORKOS_CONNECTION_ID`, users will see two login options and must provide their organization or connection ID. - If you specify either variable, only one login button appears with that default setting. You cannot specify both variables simultaneously. ### WordPress [NextAuth WordPress Provider Docs](https://next-auth.js.org/providers/wordpress) | Configuration | Value | | ------------------ | ------------------------------------------------------------------------ | | Required Variables | `AUTH_WORDPRESS_CLIENT_ID`
`AUTH_WORDPRESS_CLIENT_SECRET` | | Optional Variables | See [additional configuration](#additional-configuration) section below. | | OAuth Redirect URL | `/api/auth/callback/wordpress` | Provider: `WORDPRESS` ### Custom OAuth Provider [NextAuth Custom OAuth Provider Docs](https://next-auth.js.org/configuration/providers/oauth#using-a-custom-provider) ([source](https://github.com/langfuse/langfuse/blob/main/web/src/server/auth.ts)) | Configuration | Value | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Required Variables | `AUTH_CUSTOM_CLIENT_ID`
`AUTH_CUSTOM_CLIENT_SECRET`
`AUTH_CUSTOM_ISSUER`
`AUTH_CUSTOM_NAME` (any, used only in UI) | | Optional Variables | `AUTH_CUSTOM_SCOPE` (defaults to `"openid email profile"`)
`AUTH_CUSTOM_FETCH_USERINFO` (defaults to `false`, see [reading the profile from the `userinfo` endpoint](#custom-oauth-userinfo))
`AUTH_CUSTOM_ID_TOKEN` (defaults to `true`, see [reading the profile from the `userinfo` endpoint](#custom-oauth-userinfo))

See [additional configuration](#additional-configuration) section below for more options. | | OAuth Redirect URL | `/api/auth/callback/custom` | Provider: `CUSTOM` #### Reading the profile from the `userinfo` endpoint [#custom-oauth-userinfo] By default, Langfuse builds the user profile from the `id_token` claims. Some providers (for example Oracle IAM) do not include `email` or `name` in the ID token and only serve them from the `userinfo` endpoint. Set `AUTH_CUSTOM_FETCH_USERINFO=true` to read the profile from `userinfo` instead: ```bash AUTH_CUSTOM_FETCH_USERINFO=true ``` Claims from both sources are merged with `userinfo` taking precedence, so claims that only the ID token carries (such as `sub`) are preserved. The OIDC callback and ID token signature validation are unchanged. Keep `AUTH_CUSTOM_ID_TOKEN` at its default of `true` in this case. Setting it to `false` is not an alternative: it switches the token exchange to the plain OAuth2 callback, which fails whenever the token response contains an `id_token` — as it does for any request that includes the `openid` scope. Sign-in then fails with a generic `OAuthCallback` error. `AUTH_CUSTOM_FETCH_USERINFO` is available on version `>=v4.21.0` of Langfuse. ## HTTP Proxy for SSO Langfuse supports HTTP proxy settings for SSO providers. Configure `AUTH_HTTPS_PROXY` or `AUTH_HTTP_PROXY` to use a proxy for SSO provider requests. ## IdP-Initiated SSO [#idp-initiated-sso] Langfuse supports **IdP-initiated SSO** (Identity Provider-initiated Single Sign-On), where users can start the SSO flow directly from their identity provider (e.g., Okta, Azure AD, Keycloak, JumpCloud, etc.) instead of starting from Langfuse. _Example of IdP-initiated SSO authentication flow (Okta):_ To enable IdP-initiated SSO, configure your identity provider to redirect users to: ``` https:///auth/sso-initiate?provider= ``` - Replace `` with your Langfuse instance URL and `` with your configured provider name (e.g., `GOOGLE`, `GITHUB`, `AZURE_AD`, etc., see other variables of provider above). - Use the `Redirect to app to initiate login (OIDC Compliant)` option in your identity provider's settings. - IdP-initiated SSO is available on version `>=v3.126.0` of Langfuse. ## Additional configuration [#additional-configuration] These are additional configuration variables. Replace `` with the provider name (e.g., `GOOGLE`, `GITHUB`, `AZURE_AD`, etc., see other variables of provider above). | Variable | Description | | ---------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `AUTH_DOMAINS_WITH_SSO_ENFORCEMENT` | Comma-separated list of domains that are only allowed to sign in using SSO. Email/password sign in is disabled for these domains. E.g. `domain1.com,domain2.com` | | `AUTH_DISABLE_SIGNUP` | Set to `true` to disable sign up for new users. Only existing users can sign in. This affects all new users that try to sign up, also those who received an invite to a project and have no account yet. | | `AUTH_SESSION_MAX_AGE` | Set the maximum age of the session (JWT) in minutes. The default is 30 days (`43200`). The value must be greater than 5 minutes, as the front-end application refreshes its session every 5 minutes. | | `AUTH_IGNORE_ACCOUNT_FIELDS` | Comma-separated list of fields to ignore from the SSO IDP account when creating an account. Use this to correct errors with custom IDP providers. | | `AUTH__ALLOW_ACCOUNT_LINKING` | Set to `true` to allow merging accounts with the same email address. This is useful when users sign in with different providers or email/password but have the same email address. You need to be careful with this setting as it can lead to security issues if the emails are not verified. | | `AUTH__CLIENT_AUTH_METHOD` | Configure the token endpoint authentication method. Supported values: `client_secret_basic` (default), `client_secret_post`, `client_secret_jwt`, `private_key_jwt`, `tls_client_auth`, `self_signed_tls_client_auth`, `none`. Use `none` for PKCE flow. | | `AUTH__CHECKS` | Configure the authentication checks. Supported values: `nonce`, `none`, `pkce`, `state`. Multiple values can be provided as comma-separated list. | | `AUTH__ID_TOKEN_SIGNED_RESPONSE_ALG` | Configure algorithm that is used to sign ID Token by provider. Supported values: `RS256`, `RS384`, `RS512`, `ES256`, `ES384`, `ES512`, `PS256`, `PS384`, `PS512`, `HS256`, `HS384`, `HS512`. This setting is ignored by providers: GitHub, WorkOS | ## Troubleshooting - Make sure that `NEXTAUTH_URL` environment variable is [configured correctly](/self-hosting/configuration) if you want to use any authentication method other than email/password. - Error: _"Please sign in with the same provider that you used to create this account"._ This error occurs when you try to sign in with a different provider than the one you used to create your account. To fix this, you need to sign in with the same provider that you used to create your account or allow for account linking/takeover by setting `AUTH__ALLOW_ACCOUNT_LINKING=true` (env depends on the provider, see above). - For password reset, see the [Password Reset](#password-reset) section. - Langfuse authentication relies on email addresses. When using SSO, ensure that the user's email address is included in their IDP profile. - Error: _"OAuthCallback"_ when signing in with a custom OIDC provider. If your provider does not include `email` or `name` in the `id_token`, set `AUTH_CUSTOM_FETCH_USERINFO=true` to source the profile from the `userinfo` endpoint. See [reading the profile from the `userinfo` endpoint](#custom-oauth-userinfo). - If authentication with your provider fails, please try different applicable combinations of the `CLIENT_AUTH_METHOD` and `CHECKS` as outlined above. ## Related Resources - [SCIM & Organization API](/docs/administration/scim-and-org-api) to automate user provisioning, role assignments, and project setup after configuring SSO ## GitHub Discussions --- If you experience any issues when self-hosting Langfuse, please: 1. Check out [Troubleshooting & FAQ](/self-hosting/troubleshooting-and-faq) page. 2. Use [Ask AI](/ask-ai) to get instant answers to your questions. 3. Ask the maintainers on [GitHub Discussions](/gh-support). 4. Create a bug report or feature request on [GitHub](/issues). Enterprise-grade support is available when self-hosting Langfuse. Learn more on our [pricing page](/pricing-self-host). --- ## Agent Instructions This page is part of the [Langfuse](https://langfuse.com) documentation, published as plain Markdown for AI agents. Every page is available as Markdown by appending `.md` to its URL, or by sending an `Accept: text/markdown` header. This page: `https://langfuse.com/self-hosting/security/authentication-and-sso.md`. ### Querying these docs If the answer is not on this page, query the documentation instead of guessing: - **Semantic search** across all Langfuse docs, returning an answer with the relevant pages and excerpts. Ask a specific, self-contained question: ```bash curl -sG "https://langfuse.com/api/search-docs" --data-urlencode "query=How do I trace a LangGraph agent?" ``` - **Index of every page**: , with per-section indexes [llms-docs.txt](https://langfuse.com/llms-docs.txt), [llms-integrations.txt](https://langfuse.com/llms-integrations.txt), and [llms-self-hosting.txt](https://langfuse.com/llms-self-hosting.txt). ### Before writing Langfuse code - **Install the [Langfuse Agent Skill](https://langfuse.com/docs/api-and-data-platform/features/agent-skill).** It encodes Langfuse's own best practices for instrumentation, prompt management, and evaluation, and materially improves results. - **Read [What does a good trace look like?](https://langfuse.com/docs/observability/best-practices.md)** before instrumenting an application. - **Verify endpoints, parameters, and response fields** against the [API reference](https://api.reference.langfuse.com) instead of inferring them from code examples. - **Use the [Langfuse CLI](https://langfuse.com/docs/api-and-data-platform/features/cli)** (`npx langfuse-cli api `) to read or write traces, prompts, datasets, and scores from the terminal. Found an error in these docs? Please open an issue at .