Authentication

Authentication is on by default in V3

From 3.00.00, new installs start with authentication enabled (auth=true). You'll need to create an account the first time you open the web UI, and every Node needs an API key to connect to the Server.

First-time setup

1. Start the Server and open the web UI (http://localhost:8265 by default). Do this straight away: until an account exists, anyone who can reach the web UI can create the first account. To avoid that, set seededApiKey before starting the Server (see Automatic API Key Creation).
2. Create a local account when prompted. The first account is an admin.
3. Go to Tools -> API Keys and create an API key.
4. Set apiKey to that key on every Node, then restart the Node:
   • Desktop tray: in the Node tray's Configuration tab, paste the key into API Key and click Save & Restart.
   • Config file: set "apiKey" in configs/Tdarr_Node_Config.json.
   • Environment variable / Docker: set the apiKey env var. On the 'tdarr' container, this is used by the internal Node (if internalNode=true). Docker containers need recreating (docker compose up -d, or remove and re-run docker run) to pick up a changed env var. Alternatively, set "apiKey" in Tdarr_Node_Config.json in the mapped configs folder and restart the container. This only works while the apiKey env var is empty, as env vars take precedence.

Until a Node has a valid API key, it can't connect and won't show on the Tdarr tab. See Node socket auth failed if a Node still won't connect.

A random authSecretKey is generated automatically when the Server first starts and is used to sign sign-in tokens. You can also set it manually as an env/config variable.

You can add more users on the Tools -> Users page. To sign in with Google, Microsoft, GitHub or another OpenID Connect provider, see Single Sign-On. To use the API with an API key, see API.

Disabling authentication

Set the Tdarr Server env/config auth variable to false and restart the Server. Nodes then connect without an API key.

Only do this if the Server's ports aren't reachable by anyone you don't trust. With authentication disabled, anyone who can reach the web UI or the Server port has full control of Tdarr.

Automatic API Key Creation

For automated deployments, you can use the seededApiKey environment variable to automatically create an API key when the server starts up. This is particularly useful for Docker deployments or automated setups where you want to ensure a specific API key exists without manual intervention.

Requirements:

• The API key must start with tapi_
• The API key must be at least 14 characters long (including tapi_)
• The API key can only contain letters, numbers and underscores after tapi_
• If the API key already exists, it will not be recreated

You can generate a random key with:

echo "tapi_$(openssl rand -hex 16)"

Example:

export seededApiKey=tapi_my_secure_api_key_123

Docker example:

docker run -ti \
    -e "auth=true" \
    -e "seededApiKey=tapi_my_secure_api_key_123" \
    -e "apiKey=tapi_my_secure_api_key_123" \
    ghcr.io/haveagitgat/tdarr

Set apiKey to the same value on all your Nodes so they connect straight away. In the 'tdarr' container above, that's what lets the internal Node connect.

Automatic Admin User Creation

If no users exist when the server starts, setting seededApiKey also creates an admin user with the seededApiKey value as its password. The web UI will then show the sign in page instead of the setup prompt, so the server can't be claimed by someone else before you sign in.

The admin user is only created when there are no users, so changing its password in the web UI or changing seededApiKey later will not reset it. You can change the password after signing in if you want it to be different from the API key.