LibreChatAuthentication
Quick overview of the user authentication system of LibreChat, which offers secure and easy email and social logins.
LibreChat has a user authentication system that allows users to sign up and log in securely and easily. The system is scalable and can handle a large number of concurrent users without compromising performance or security.
By default, we have email signup and login enabled, which means users can create an account using their email address and a password. They can also reset their password if they forget it.
Additionally, our system can integrate social logins from various platforms such as Google, GitHub, Discord, OpenID, and more. This means users can log in using their existing accounts on these platforms, without having to create a new account or remember another password.
For further details, refer to the configuration guides provided here: Authentication
Important
- When you run an unscoped single-tenant deployment for the first time, create an account by clicking Sign up on the login page. That first account becomes the admin and holds all administrative capabilities on the instance. Tenant-scoped deployments do not auto-promote their first registered user; provision tenant administrators through a trusted administrative flow. See Access Control for the full authorization model covering users, groups, roles, resource ACLs, and system-level admin grants.
- For an unscoped single-tenant deployment, the first account should ideally be a local account (email and password).
See also: Access Control, LibreChat's granular permission system for users, groups, and roles, covering per-resource sharing of agents, prompts, MCP servers, and feature-level permissions.
Staying Signed In
Using LibreChat requires an account. There is no anonymous or guest mode for chatting, so you cannot start a conversation without logging in. The one exception is viewing: when an admin sets ALLOW_SHARED_LINKS_PUBLIC=true, anyone holding a shared link can read that conversation without an account. They can only read it.
Two settings decide how long a session lasts, and both are configurable:
SESSION_EXPIRY: how long an access token stays valid. Defaults to 15 minutes.REFRESH_TOKEN_EXPIRY: how long you stay signed in overall. Defaults to 7 days.
The short access token is renewed automatically in the background while you are using LibreChat, so the 15-minute figure is not how often you are asked to log in again. Being signed out usually means the refresh token reached the end of its window, or the browser dropped the refresh cookie.
Each renewal does hand back a new refresh token, but it is signed against the same session and inherits that session's original expiry. REFRESH_TOKEN_EXPIRY is therefore measured from when you logged in, not from your last activity: staying active does not extend it, and you are signed out when the window runs out.
If you are being logged out sooner than expected, raise REFRESH_TOKEN_EXPIRY. Both variables are documented in the .env reference.
OpenID token reuse changes who owns the session
Everything above describes refresh tokens that LibreChat issues itself. With OPENID_REUSE_TOKENS=true, the cookie holds your OpenID provider's refresh token instead, so that provider's lifetime, rotation, and revocation policy decide when the session ends. REFRESH_TOKEN_EXPIRY does not extend an IdP credential that has expired or been revoked; change the session policy at the provider.
How is this guide?
Import Conversations
Conversations Import allows user to import conversations exported from other AI chat applications. Currently, we support importing conversations from ChatGPT, Claude, and ChatbotUI v1.
Access Control
LibreChat's granular authorization system - control who can use, share, edit, and manage agents, prompts, MCP servers, and other resources at the user, group, role, and instance level.