# Authentication (https://www.librechat.ai/docs/features/authentication)
LibreChat has a user authentication system that allows users to sign up and log in securely and easily. The system is scalable and can handle a large number of concurrent users without compromising performance or security.
By default, we have email signup and login enabled, which means users can create an account using their email address and a password. They can also reset their password if they forget it.
Additionally, our system can integrate social logins from various platforms such as Google, GitHub, Discord, OpenID, and more. This means users can log in using their existing accounts on these platforms, without having to create a new account or remember another password.
**For further details, refer to the configuration guides provided here: [Authentication](/docs/configuration/authentication)**
- When you run an unscoped single-tenant deployment for the first time, create an account by clicking **Sign up** on the login page. That first account becomes the admin and holds all administrative capabilities on the instance. Tenant-scoped deployments do not auto-promote their first registered user; provision tenant administrators through a trusted administrative flow. See [Access Control](/docs/features/access_control) for the full authorization model covering users, groups, roles, resource ACLs, and system-level admin grants.
- For an unscoped single-tenant deployment, the first account should ideally be a local account (email and password).
**See also:** [Access Control](/docs/features/access_control), LibreChat's granular permission system for users, groups, and roles, covering per-resource sharing of agents, prompts, MCP servers, and feature-level permissions.
## Staying Signed In
Using LibreChat requires an account. There is no anonymous or guest mode for chatting, so you cannot start a conversation without logging in. The one exception is viewing: when an admin sets `ALLOW_SHARED_LINKS_PUBLIC=true`, anyone holding a [shared link](/docs/features/shareable_links) can read that conversation without an account. They can only read it.
Two settings decide how long a session lasts, and both are configurable:
- `SESSION_EXPIRY`: how long an access token stays valid. Defaults to **15 minutes**.
- `REFRESH_TOKEN_EXPIRY`: how long you stay signed in overall. Defaults to **7 days**.
The short access token is renewed automatically in the background while you are using LibreChat, so the 15-minute figure is not how often you are asked to log in again. Being signed out usually means the refresh token reached the end of its window, or the browser dropped the refresh cookie.
Each renewal does hand back a new refresh token, but it is signed against the same session and inherits that session's original expiry. `REFRESH_TOKEN_EXPIRY` is therefore measured from when you logged in, not from your last activity: staying active does not extend it, and you are signed out when the window runs out.
If you are being logged out sooner than expected, raise `REFRESH_TOKEN_EXPIRY`. Both variables are documented in the [.env reference](/docs/configuration/dotenv).
Everything above describes refresh tokens that LibreChat issues itself. With [`OPENID_REUSE_TOKENS=true`](/docs/configuration/authentication/OAuth2-OIDC/token-reuse), the cookie holds your OpenID provider's refresh token instead, so that provider's lifetime, rotation, and revocation policy decide when the session ends. `REFRESH_TOKEN_EXPIRY` does not extend an IdP credential that has expired or been revoked; change the session policy at the provider.