> ## Documentation Index
> Fetch the complete documentation index at: https://snapr.seshuk.im/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Enable JWT-based login for the snapr web UI and protect API endpoints with server.auth.

`server.auth` enables a login flow for the web UI and protects the API endpoints. Authentication is JWT-based.

## Options

| Option            | Type   | Required | Default | Description                                                |
| ----------------- | ------ | -------- | ------- | ---------------------------------------------------------- |
| `enabled`         | bool   | No       | `false` | Turns authentication on.                                   |
| `username`        | string | Yes\*    | —       | Login username. Required when `enabled: true`.             |
| `password`        | string | Yes\*    | —       | Login password. Required when `enabled: true`. Use `env:`. |
| `tokenExpiration` | int    | No       | `30`    | Minutes before the JWT expires.                            |
| `cookies`         | object | No       | —       | Cookie attributes, see below.                              |

### `cookies`

| Option     | Type   | Required | Default | Description                    |
| ---------- | ------ | -------- | ------- | ------------------------------ |
| `secure`   | bool   | No       | `false` | Sets the `Secure` cookie flag. |
| `sameSite` | string | No       | —       | `lax`, `strict`, or `none`.    |
| `domain`   | string | No       | —       | Cookie `Domain` attribute.     |

## Example

```yaml snapr.yaml theme={null}
server:
  secret: env:SNAPR_JWT_SECRET
  auth:
    enabled: true
    username: admin
    password: env:SNAPR_ADMIN_PASSWORD
    tokenExpiration: 1440
    cookies:
      secure: true
      sameSite: strict
      domain: snapr.example.com
```

<Warning>
  Always set `server.secret` when authentication is enabled. A weak or default secret allows token forgery.
</Warning>

<Tip>For HTTPS deployments behind a reverse proxy, set `cookies.secure: true`.</Tip>