Your First Chat

Open a running LibreChat instance, create your account, add a model API key, and send your first message.

LibreChat is software you host yourself, and it ships with no API key of its own. Once your instance is running, these steps take you from the login page to a working conversation.

Nothing running yet?

Install LibreChat first: Quick Start for the 5-minute Docker path, Local Installation for Docker, npm, or Helm, or Remote Hosting to deploy it on a server.

To try LibreChat before installing anything, the project runs a free public demo at chat.librechat.ai. It is meant for evaluation, not for private data.

Open LibreChat in your browser

A local Docker or npm install serves the app at http://localhost:3080. The port comes from PORT. If you changed it, or mapped a different host port in docker-compose.override.yml, use that one instead.

Anywhere else, the address is the one your deployment hands you: the domain Railway assigns, your username-projectname.hf.space URL on Hugging Face, the server IP or domain in front of your remote Docker or Kubernetes install. DOMAIN_CLIENT is a separate setting, the address LibreChat puts in the links it generates, so point it at that same public URL rather than reading your browsing address out of it.

If nothing loads, see If nothing loads below.

Create your account

Email registration is enabled by default (ALLOW_REGISTRATION=true), and there are no default credentials: click Sign up and choose your own email and password.

Not every instance offers that form. If there is no Sign up, use a provider button if one is shown, or the login form if the instance authenticates against a directory: either may create your account on first sign-in. When none is offered, or when signing in is refused because your account does not exist, ask whoever runs the instance for one. Which controls appear is decided by the instance's authentication settings.

First Account = Admin in Single-Tenant Deployments

In an unscoped single-tenant deployment, the first account registered becomes the admin account, and every account after it gets the USER role by default. Tenant-scoped deployments do not auto-promote the first user in each tenant; provision tenant administrators through a trusted administrative flow (Authentication).

An OpenID deployment can override the default role either way: OPENID_ADMIN_ROLE elevates a matching account to admin, and generic role sync (OPENID_ROLE_SYNC_ENABLED) maps provider roles onto other non-admin roles. See OpenID Connect.

If you configured OAuth2/OIDC or SAML, use that provider's button instead of the form.

LDAP/AD adds no button. Sign in on the same email and password form, entering your directory username in place of the email when the server sets LDAP_LOGIN_USES_USERNAME=true.

Give a model an API key

LibreChat talks to AI providers with your credentials, and .env.example ships the pre-configured providers as user_provided:

OPENAI_API_KEY=user_provided
ANTHROPIC_API_KEY=user_provided
GOOGLE_KEY=user_provided

With that value, every user supplies their own key from the web UI: select the endpoint, open the gear icon next to it, and fill in the Set API Key dialog.

That value is a default only where the install starts from .env.example, which means Docker and npm. A Helm release, a Railway service or a Hugging Face Space carries only the variables you set, so an endpoint whose credential you never set does not load at all, and no key dialog appears for it. Set the variable to user_provided there before expecting users to bring their own keys, and roll the workload so running pods or containers pick it up. The same dialog is reachable from Settings → Data & Privacy → API keys, which is also where keys are reviewed and rotated later.

If you see no endpoint dropdown and no gear icon, this instance keeps the selector hidden, through model specs or its interface settings. Set your first key from Settings → Data & Privacy → API keys, which lists the endpoints configured to take a user-provided key.

To configure a key once for everyone instead, set the real key in place of user_provided and restart LibreChat. On Docker, recreate the containers with docker compose up -d, adding -f ./deploy-compose.yml if that is the file your stack runs from: docker compose restart keeps the environment the container already has, so the old value survives. No user is prompted, and the key stays on the server. Where you set it depends on how you installed: .env for Docker and npm, a Kubernetes Secret for Helm, the service's variables in the Railway dashboard, Space Secrets on Hugging Face. Provider-by-provider steps live in AI Setup.

A shared key on a public URL is anyone's to spend

Registration is open by default, so on an instance reachable from the internet, whoever finds the URL can sign up and bill your key. Before you configure a server-side key on a public deployment, make sure nobody you did not intend can get an account. The email form, each provider button and any directory you authenticate against all create users on their own terms, so closing one is not closing them all; Authentication covers the setting behind each. Leaving the providers at user_provided avoids the problem entirely.

No paid API key?

Run a model on your own hardware with Ollama, or reach many providers through a gateway such as OpenRouter. Both are added as custom endpoints.

Send your first message

Pick an endpoint and model from the selector at the top of the chat, type your prompt, and send it. Where the instance hides the selector, it has already chosen for you: type and send. The reply streams in, and the conversation is saved so you can return to it from the sidebar.

If nothing loads

A page that never appears is an install problem, and the check depends on how you installed:

Docker. Confirm the containers are running with docker compose ps, then read the API logs with docker compose logs api. On a server set up with the Docker on Linux guide, the stack runs from a non-default compose file, so use sudo docker compose -f ./deploy-compose.yml ps and sudo docker compose -f ./deploy-compose.yml logs api. More in Docker troubleshooting.
npm. LibreChat runs in the terminal where you started npm run backend, so read that terminal's output. If the process has exited, start it again and read the error it prints.
Helm or another Kubernetes install. Check that the pods are running with kubectl get pods -n <release-namespace>, read the API pod with kubectl logs -n <release-namespace> <pod>, and confirm the service or ingress actually exposes the port you are browsing to. Both commands default to your current namespace, so an empty list usually means the wrong one.
Railway or another host. Open the deployment logs in the provider's dashboard (in Railway, the View logs button on the service), and browse to the public URL the provider assigned rather than localhost.

If no model answers

The endpoint itself is missing from the selector. Three separate settings can hide it, so check each. ENDPOINTS in .env: when it is set, only the endpoints named there load at all. Model specs in librechat.yaml: where they limit the selector, only the specs you listed and anything in modelSpecs.addedEndpoints is reachable. And the provider's own key: a key-based endpoint with no value configured does not load, so set its key (or user_provided) wherever your install keeps its environment, then restart, recreating the containers with docker compose up -d on Docker. An endpoint that takes credentials from its environment instead, Bedrock from the AWS credential chain for example, needs its region set and a working chain rather than a key.
The endpoint is there, but the model you want is not. Where the list comes from decides what to check. With a user_provided key, LibreChat cannot ask the provider which models exist, so it offers a built-in list: name the models you want with the provider's _MODELS variable, for example OPENAI_MODELS. With a real server-side key and _MODELS left unset, some providers are asked for their list, so a restricted or failing key can shorten it; others, Google among them, never fetch and need _MODELS set whatever the key is. Check that provider's own page in AI Setup before changing anything else. A custom endpoint such as Ollama or OpenRouter ignores _MODELS entirely: its list comes from models.default and models.fetch in its own librechat.yaml block. And if your librechat.yaml defines model specs, you pick from that list instead of the endpoint's own models.
The reply fails with an authentication or invalid-key error. The key is wrong, expired, or has no access to the selected model. Re-enter it in the Set API Key dialog, or fix the value in your install's environment and restart.