Authentication settings

Every setting below is read from the environment variable in the second column, or from the same key in a YAML configuration file. An unrecognised FANOUT_-prefixed variable is a startup error, so a renamed setting surfaces as a refusal to start rather than as a default nobody chose.

Setting	Environment variable	Type	Default
auth.code_secret	FANOUT_AUTH_CODE_SECRET	string · secret	—
auth.mode	FANOUT_AUTH_MODE	string	local
auth.oidc.admin_groups	FANOUT_OIDC_ADMIN_GROUPS	string	—
auth.oidc.allowed_domains	FANOUT_OIDC_ALLOWED_DOMAINS	string	—
auth.oidc.allowed_groups	FANOUT_OIDC_ALLOWED_GROUPS	string	—
auth.oidc.auto_provision	FANOUT_OIDC_AUTO_PROVISION	boolean	false
auth.oidc.client_id	FANOUT_OIDC_CLIENT_ID	string	—
auth.oidc.client_secret	FANOUT_OIDC_CLIENT_SECRET	string · secret	—
auth.oidc.default_role	FANOUT_OIDC_DEFAULT_ROLE	string	viewer
auth.oidc.email_claim	FANOUT_OIDC_EMAIL_CLAIM	string	email
auth.oidc.email_verification	FANOUT_OIDC_EMAIL_VERIFICATION	string	required
auth.oidc.issuer_url	FANOUT_OIDC_ISSUER_URL	string	—
auth.oidc.operator_groups	FANOUT_OIDC_OPERATOR_GROUPS	string	—
auth.self_signup	FANOUT_SELF_SIGNUP	boolean	false
auth.session_absolute_ttl	FANOUT_SESSION_ABSOLUTE_TTL	duration	168h
auth.session_idle_ttl	FANOUT_SESSION_IDLE_TTL	duration	12h

Secrets

Settings marked secret are redacted from Fanout’s startup configuration log. They are still plain environment variables: anything that can read the process environment can read them.