Auth

• Connection screen: Connect to Cantinarr explains that the app needs a separate Cantinarr server running on a computer or NAS, which connects to Radarr, Sonarr, Plex, and other services. The Link or Cantinarr address field accepts a connection link or server address: Connect redeems a complete invitation directly, or checks an address and opens that server’s setup or sign-in screen. Incomplete invitations show an error and are never probed as server addresses. The screen explains where to get a link and includes Set up a Cantinarr server, which opens the installation guide in a browser with a copyable address if the browser cannot open.
• Saved servers: successful password, passkey, Plex, SSO, connection-link, and setup sign-ins remember the server on this device (or browser origin). When native sign-in is needed again, the last address is prefilled and checked in the background while the connection screen stays open. Sign in with passkey appears there with the server’s name/address when both the server and device support it, the server is set up, and SSO is not required. Editing the field hides that passkey option until another server is checked. Saved servers expands the saved choices; selecting one opens its current sign-in options. Forget removes a shortcut with Undo; the next most recently used remaining server becomes the default. Sign-out and session expiry keep these shortcuts, and existing installations import their stored server once. Only addresses and names are saved, with one authenticated server active at a time. Hosted web still opens the last server’s sign-in/setup directly, falling back to its hosting origin when there is no saved server.
• Connect links: open one and the account connects (SSO-only servers require successful provider sign-in before redeeming it) (cantinarr://connect deep links on iOS); passwordless by default with a long-lived, auto-refreshing session. Opening one while already signed in offers to switch servers instead; the link is redeemed first and the current session is only replaced once the new server accepts it, so an expired link never signs anyone out.
• First-run setup: after a server address is entered, a server needing setup opens admin account creation followed by an optional passkey offer. The scheme is optional: a bare address is probed over https first and falls back to http only when https is unreachable (a typed scheme is always respected).
• Single sign-on: Web, iOS and Android use an external OIDC provider through the browser. Settings > Single sign-on configures it; Account > Linked sign-in links an existing account, and the Users menu exposes linked identities. Web uses the external origin and tab storage; native cantinarr://oidc returns use a verifier kept in secure storage across app restarts. Cancellation preserves the current session. Setup and recovery.
• Passkeys & passwords: native passkey sign-in on associated deployments (iOS/Android/Windows platform plugins, browser fallback), password login where enabled.
• Session resilience: the session survives transport failures and VPN flaps; only a genuine 401 clears it. Settings > Sign out revokes this device; administrators can also revoke devices server-side.
• Separate OAuth directions: ChatGPT and xAI device authorizations are explicit outbound sign-ins that let Cantinarr use a personal or admin-shared subscription allowance. Cantinarr’s MCP OAuth is a different inbound login that lets an external client access Cantinarr.

Plex sign-in uses Continue with Plex on the login screen and /plex/continue for browser approval, polling, reopen/check/cancel/retry, and recovery after a tab refresh or native restart. Pending attempts retain the originating server and purpose in browser tab storage or native secure storage. Older servers omit plex_available and show no Plex button. Under OIDC-only policy the button is labeled administrator recovery. Successful login uses the normal session/configuration adoption path; failure or cancellation preserves an existing connection.

Administrators configure Settings > Plex sign-in (/settings/plex-auth), with separate enablement and automatic-signup switches and an explicit fresh mapping review. Linked sign-in displays both OIDC and Plex identities for users and administrators. Media-link/import outcomes distinguish a successful library-account link from a conflicting or unavailable Plex login identity. See Plex setup.

OIDC routes: /oidc/start, /oidc/return, /settings/oidc (admin), /settings/sso-account, and /settings/users/:userId/sso (admin). The router retains the browser callback while a saved session is restored, including account linking and Test sign-in returns. The crypto package creates the S256 challenge; web provides temporary browser tab storage.

View the maintained source for this page.