Auth

• Saved servers: successful password, passkey, Plex, SSO, connection-link, and setup sign-ins remember the server on this device (or browser origin). When sign-in is needed again, the last server opens automatically with its current sign-in options. Tap the server badge to Change server: saved buttons show each server’s name and address, alongside manual address entry and connection links. Forget removes a shortcut with Undo; the next most recently used remaining server becomes the default. Sign-out and session expiry keep these shortcuts, and existing installations import their stored server once. Only addresses and names are saved, with one authenticated server active at a time. With no saved servers, web detects its hosting origin and native apps ask for an address.
• Connect links: open one and the account connects (SSO-only servers require successful provider sign-in before redeeming it) (cantinarr://connect deep links on iOS); passwordless by default with a long-lived, auto-refreshing session. Opening one while already signed in offers to switch servers instead; the link is redeemed first and the current session is only replaced once the new server accepts it, so an expired link never signs anyone out.
• First-run setup: the auth screen walks through server URL → admin account creation → an optional passkey offer. The scheme is optional: a bare address is probed over https first and falls back to http only when https is unreachable (a typed scheme is always respected).
• Single sign-on: Web, iOS and Android use an external OIDC provider through the browser. Settings > Single sign-on configures it; Account > Linked sign-in links an existing account, and the Users menu exposes linked identities. Web uses the external origin and tab storage; native cantinarr://oidc returns use a verifier kept in secure storage across app restarts. Cancellation preserves the current session. Setup and recovery.
• Passkeys & passwords: native passkey sign-in on associated deployments (iOS/Android/Windows platform plugins, browser fallback), password login where enabled.
• Session resilience: the session survives transport failures and VPN flaps; only a genuine 401 clears it. Settings > Sign out revokes this device; administrators can also revoke devices server-side.
• Separate OAuth directions: ChatGPT and xAI device authorizations are explicit outbound sign-ins that let Cantinarr use a personal or admin-shared subscription allowance. Cantinarr’s MCP OAuth is a different inbound login that lets an external client access Cantinarr.

Plex sign-in uses Continue with Plex on the login screen and /plex/continue for browser approval, polling, reopen/check/cancel/retry, and recovery after a tab refresh or native restart. Pending attempts retain the originating server and purpose in browser tab storage or native secure storage. Older servers omit plex_available and show no Plex button. Under OIDC-only policy the button is labeled administrator recovery. Successful login uses the normal session/configuration adoption path; failure or cancellation preserves an existing connection.

Administrators configure Settings > Plex sign-in (/settings/plex-auth), with separate enablement and automatic-signup switches and an explicit fresh mapping review. Linked sign-in displays both OIDC and Plex identities for users and administrators. Media-link/import outcomes distinguish a successful library-account link from a conflicting or unavailable Plex login identity. See Plex setup.

OIDC routes: /oidc/start, /oidc/return, /settings/oidc (admin), /settings/sso-account, and /settings/users/:userId/sso (admin). The router retains the browser callback while a saved session is restored, including account linking and Test sign-in returns. The crypto package creates the S256 challenge; web provides temporary browser tab storage.

View the maintained source for this page.