Authentication and SSO

Authentication

Email/Password

Email/password authentication is enabled by default. Users can sign up and log in using their email and password.

To disable email/password authentication, set AUTH_DISABLE_USERNAME_PASSWORD=true. In this case, you need to set up SSO instead.

If you want to provision a default user for your Langfuse instance, you can use the LANGFUSE_INIT_* environment variables.

Password Reset

• If transactional emails are configured on your instance via the SMTP_CONNECTION_URL and EMAIL_FROM_ADDRESS environments, users can reset their password by using the “Forgot password” link on the login page.

• If transactional emails are not set up, passwords can be reset by following these steps:

1. Update the email associated with your user account in database, such as by adding a prefix.
2. You can then sign up again with a new password.
3. Reassign any organizations you were associated with via the organization_memberships table in database.
4. Finally, remove the old user account from the users table in database.

SSO

To enable OAuth/SSO provider sign-in for Langfuse, add the following environment variables:

Use *_ALLOW_ACCOUNT_LINKING to allow merging accounts with the same email address. This is useful when users sign in with different providers or email/password but have the same email address. You need to be careful with this setting as it can lead to security issues if the emails are not verified.

Need another provider? Langfuse uses Auth.js, which integrates with many providers. Add a feature request on GitHub if you want us to add support for a specific provider.

Additional configuration

Instance administration