Sign-in

Sign-in is optional. With none configured, Bibliup runs open under one shared Default account, which suits a single person or a trusted home network.

To turn it on, set AUTH_OIDC_ISSUER, AUTH_OIDC_ID, AUTH_OIDC_SECRET and AUTH_SECRET for any OIDC provider (Authentik, Keycloak, Authelia, Pocket ID, ...). Register <origin>/api/auth/callback/oidc and <origin>/login as redirect URIs; only the openid, profile and email scopes are requested. The first person to sign in becomes the administrator, and manages everyone else in Settings -> Access: who is an administrator and which collections each person can see. Only administrators manage the library.

Behind a reverse proxy, set AUTH_URL to the public origin (or leave AUTH_TRUST_HOST=true), or sign-in, note co-editing and MCP will be checked against the wrong address.