# Your First Chat (https://www.librechat.ai/docs/quick_start/first_chat)

LibreChat is software you host yourself, and it ships with no API key of its own. Once your instance is running, these steps take you from the login page to a working conversation.

<Callout type="info" title="Nothing running yet?">

Install LibreChat first: [Quick Start](/docs/quick_start) for the 5-minute Docker path, [Local Installation](/docs/local) for Docker, npm, or Helm, or [Remote Hosting](/docs/remote) to deploy it on a server.

To try LibreChat before installing anything, the project runs a free public demo at [chat.librechat.ai](https://chat.librechat.ai). It is meant for evaluation, not for private data.

</Callout>

<Steps>
  <Step>

### Open LibreChat in your browser

A local Docker or npm install serves the app at [http://localhost:3080](http://localhost:3080). The port comes from `PORT`. If you changed it, or mapped a different host port in `docker-compose.override.yml`, use that one instead.

Anywhere else, the address is the one your deployment hands you: the domain Railway assigns, your `username-projectname.hf.space` URL on Hugging Face, the server IP or domain in front of your remote Docker or Kubernetes install. `DOMAIN_CLIENT` is a separate setting, the address LibreChat puts in the links it generates, so point it at that same public URL rather than reading your browsing address out of it.

If nothing loads, see [If nothing loads](#if-nothing-loads) below.

  </Step>
  <Step>

### Create your account

Email registration is enabled by default (`ALLOW_REGISTRATION=true`), and there are no default credentials: click **Sign up** and choose your own email and password.

Not every instance offers that form. If there is no **Sign up**, use a provider button if one is shown, or the login form if the instance authenticates against a directory: either may create your account on first sign-in. When none is offered, or when signing in is refused because your account does not exist, ask whoever runs the instance for one. Which controls appear is decided by the instance's [authentication settings](/docs/configuration/authentication).

<Callout type="info" title="First Account = Admin in Single-Tenant Deployments">

In an unscoped single-tenant deployment, the first account registered becomes the admin account, and every account after it gets the `USER` role by default. Tenant-scoped deployments do not auto-promote the first user in each tenant; provision tenant administrators through a trusted administrative flow ([Authentication](/docs/features/authentication)).

An OpenID deployment can override the default role either way: `OPENID_ADMIN_ROLE` elevates a matching account to admin, and generic role sync (`OPENID_ROLE_SYNC_ENABLED`) maps provider roles onto other non-admin roles. See [OpenID Connect](/docs/configuration/dotenv#openid-connect).

</Callout>

If you configured [OAuth2/OIDC](/docs/configuration/authentication/OAuth2-OIDC) or [SAML](/docs/configuration/authentication/SAML), use that provider's button instead of the form.

[LDAP/AD](/docs/configuration/authentication/ldap) adds no button. Sign in on the same email and password form, entering your directory username in place of the email when the server sets `LDAP_LOGIN_USES_USERNAME=true`.

  </Step>
  <Step>

### Give a model an API key

LibreChat talks to AI providers with your credentials, and `.env.example` ships the pre-configured providers as `user_provided`:

```bash filename=".env"
OPENAI_API_KEY=user_provided
ANTHROPIC_API_KEY=user_provided
GOOGLE_KEY=user_provided
```

With that value, every user supplies their own key from the web UI: select the endpoint, open the gear icon next to it, and fill in the **Set API Key** dialog.

That value is a default only where the install starts from `.env.example`, which means Docker and npm. A Helm release, a Railway service or a Hugging Face Space carries only the variables you set, so an endpoint whose credential you never set does not load at all, and no key dialog appears for it. Set the variable to `user_provided` there before expecting users to bring their own keys, and roll the workload so running pods or containers pick it up. The same dialog is reachable from **Settings → Data & Privacy → API keys**, which is also where keys are reviewed and rotated later.

If you see no endpoint dropdown and no gear icon, this instance keeps the selector hidden, through [model specs](/docs/configuration/librechat_yaml/object_structure/model_specs) or its `interface` settings. Set your first key from **Settings → Data & Privacy → API keys**, which lists the endpoints configured to take a user-provided key.

To configure a key once for everyone instead, set the real key in place of `user_provided` and restart LibreChat. On Docker, recreate the containers with `docker compose up -d`, adding `-f ./deploy-compose.yml` if that is the file your stack runs from: `docker compose restart` keeps the environment the container already has, so the old value survives. No user is prompted, and the key stays on the server. Where you set it depends on how you installed: `.env` for Docker and npm, a Kubernetes Secret for [Helm](/docs/local/helm_chart#configuration), the service's variables in the Railway dashboard, Space Secrets on [Hugging Face](/docs/remote/huggingface). Provider-by-provider steps live in [AI Setup](/docs/configuration/pre_configured_ai).

<Callout type="warn" title="A shared key on a public URL is anyone's to spend">

Registration is open by default, so on an instance reachable from the internet, whoever finds the URL can sign up and bill your key. Before you configure a server-side key on a public deployment, make sure nobody you did not intend can get an account. The email form, each provider button and any directory you authenticate against all create users on their own terms, so closing one is not closing them all; [Authentication](/docs/configuration/authentication) covers the setting behind each. Leaving the providers at `user_provided` avoids the problem entirely.

</Callout>

<Callout type="info" title="No paid API key?">

Run a model on your own hardware with [Ollama](/docs/configuration/librechat_yaml/ai_endpoints/ollama), or reach many providers through a gateway such as [OpenRouter](/docs/configuration/librechat_yaml/ai_endpoints/openrouter). Both are added as [custom endpoints](/docs/quick_start/custom_endpoints).

</Callout>

  </Step>
  <Step>

### Send your first message

Pick an endpoint and model from the selector at the top of the chat, type your prompt, and send it. Where the instance hides the selector, it has already chosen for you: type and send. The reply streams in, and the conversation is saved so you can return to it from the sidebar.

  </Step>
</Steps>

## If nothing loads

A page that never appears is an install problem, and the check depends on how you installed:

- **Docker.** Confirm the containers are running with `docker compose ps`, then read the API logs with `docker compose logs api`. On a server set up with the [Docker on Linux](/docs/remote/docker_linux) guide, the stack runs from a non-default compose file, so use `sudo docker compose -f ./deploy-compose.yml ps` and `sudo docker compose -f ./deploy-compose.yml logs api`. More in [Docker troubleshooting](/docs/local/docker#troubleshooting).
- **npm.** LibreChat runs in the terminal where you started `npm run backend`, so read that terminal's output. If the process has exited, start it again and read the error it prints.
- **[Helm](/docs/local/helm_chart) or another Kubernetes install.** Check that the pods are running with `kubectl get pods -n <release-namespace>`, read the API pod with `kubectl logs -n <release-namespace> <pod>`, and confirm the service or ingress actually exposes the port you are browsing to. Both commands default to your current namespace, so an empty list usually means the wrong one.
- **Railway or another host.** Open the deployment logs in the provider's dashboard (in Railway, the **View logs** button on the service), and browse to the public URL the provider assigned rather than `localhost`.

## If no model answers

- **The endpoint itself is missing from the selector.** Three separate settings can hide it, so check each. `ENDPOINTS` in `.env`: when it is set, only the endpoints named there load at all. [Model specs](/docs/configuration/librechat_yaml/object_structure/model_specs) in `librechat.yaml`: where they limit the selector, only the specs you listed and anything in `modelSpecs.addedEndpoints` is reachable. And the provider's own key: a key-based endpoint with no value configured does not load, so set its key (or `user_provided`) wherever your install keeps its environment, then restart, recreating the containers with `docker compose up -d` on Docker. An endpoint that takes credentials from its environment instead, [Bedrock](/docs/configuration/pre_configured_ai/bedrock) from the AWS credential chain for example, needs its region set and a working chain rather than a key.
- **The endpoint is there, but the model you want is not.** Where the list comes from decides what to check. With a `user_provided` key, LibreChat cannot ask the provider which models exist, so it offers a built-in list: name the models you want with the provider's `_MODELS` variable, for example [`OPENAI_MODELS`](/docs/configuration/pre_configured_ai/openai). With a real server-side key and `_MODELS` left unset, some providers are asked for their list, so a restricted or failing key can shorten it; others, [Google](/docs/configuration/pre_configured_ai/google) among them, never fetch and need `_MODELS` set whatever the key is. Check that provider's own page in [AI Setup](/docs/configuration/pre_configured_ai) before changing anything else. A [custom endpoint](/docs/configuration/librechat_yaml/object_structure/custom_endpoint) such as Ollama or OpenRouter ignores `_MODELS` entirely: its list comes from `models.default` and `models.fetch` in its own `librechat.yaml` block. And if your `librechat.yaml` defines [model specs](/docs/configuration/librechat_yaml/object_structure/model_specs), you pick from that list instead of the endpoint's own models.
- **The reply fails with an authentication or invalid-key error.** The key is wrong, expired, or has no access to the selected model. Re-enter it in the **Set API Key** dialog, or fix the value in your install's environment and restart.

## Next steps

<Cards num={2}>
  <Cards.Card title="Connect More Providers" href="/docs/quick_start/custom_endpoints" arrow>
    Add Ollama, OpenRouter, Groq, and other OpenAI-compatible services
  </Cards.Card>
  <Cards.Card title="AI Overview" href="/docs/user_guides/ai_overview" arrow>
    Understand endpoints, models, and presets in the chat UI
  </Cards.Card>
  <Cards.Card title="Save Presets" href="/docs/user_guides/presets" arrow>
    Reuse a model, prompt, and settings combination in new chats
  </Cards.Card>
  <Cards.Card title="Explore Features" href="/docs/features" arrow>
    Agents, MCP tools, web search, file chat, image generation, and more
  </Cards.Card>
</Cards>