Authentication - snapr

server.auth enables a login flow for the web UI and protects the API endpoints. Authentication is JWT-based.

Options

Option	Type	Required	Default	Description
`enabled`	bool	No	`false`	Turns authentication on.
`username`	string	Yes*	—	Login username. Required when `enabled: true`.
`password`	string	Yes*	—	Login password. Required when `enabled: true`. Use `env:`.
`tokenExpiration`	int	No	`30`	Minutes before the JWT expires.
`cookies`	object	No	—	Cookie attributes, see below.

`cookies`

Option	Type	Required	Default	Description
`secure`	bool	No	`false`	Sets the `Secure` cookie flag.
`sameSite`	string	No	—	`lax`, `strict`, or `none`.
`domain`	string	No	—	Cookie `Domain` attribute.

Example

snapr.yaml

server:
  secret: env:SNAPR_JWT_SECRET
  auth:
    enabled: true
    username: admin
    password: env:SNAPR_ADMIN_PASSWORD
    tokenExpiration: 1440
    cookies:
      secure: true
      sameSite: strict
      domain: snapr.example.com

Always set server.secret when authentication is enabled. A weak or default secret allows token forgery.

For HTTPS deployments behind a reverse proxy, set cookies.secure: true.